This privacy policy has been compiled to better serve those who are concerned with how their 'Personally Identifiable Information' (PII) is being used online. PII, as described in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.
What personal information do we collect from the people that visit our blog, website or app?
When ordering or registering on our site, as appropriate, you may be asked to enter your name, email address, mailing address, phone number, credit card information, social security number or other details to help you with your experience
When do we collect information?
We collect information from you when you register on our site, place an order, subscribe to a newsletter, respond to a survey, fill out a form, Use Live Chat, Open a Support Ticket or enter information on our site.
Provide us with feedback on our products or services
How do we use your information?
We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:
• To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
• To improve our website in order to better serve you.
• To allow us to better service you in responding to your customer service requests.
• To quickly process your transactions.
• To ask for ratings and reviews of services or products
• To follow up with them after correspondence (live chat, email or phone inquiries)
How do we protect your information?
Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible.
We use regular Malware Scanning. Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.
We implement a variety of security measures when a user places an order enters, submits, or accesses their information to maintain the safety of your personal information
We use cookies to:
• Help remember and process the items in the shopping cart.
• Understand and save user's preferences for future visits.
• Keep track of advertisements.
• Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf.
You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since browser is a little different, look at your browser's Help Menu to learn the correct way to modify your cookie.
Third-party disclosure
We do not sell, trade, or otherwise transfer to outside parties your Personally Identifiable Information unless we provide users with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential. We may also release information when it's release is appropriate to comply with the law, enforce our site policies, or protect ours or others' rights, property or safety.
However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.
We have implemented the following:
• Remarketing with Google AdSense
• Google Display Network Impression Reporting
• Demographics and Interests Reporting
• DoubleClick Platform Integration
According to CalOPPA, we agree to the following:
Users can visit our site anonymously.
Once this privacy policy is created, we will add a link to it on our home page or as a minimum, on the first significant page after entering our website.
Our Privacy Policy link includes the word 'Privacy' and can easily be found on the page specified above.
According to CalOPPA, we agree to the following:
Users can visit our site anonymously.
Once this privacy policy is created, we will add a link to it on our home page or as a minimum, on the first significant page after entering our website.
Our Privacy Policy link includes the word 'Privacy' and can easily be found on the page specified above.
How does our site handle Do Not Track signals?
We honor Do Not Track signals and Do Not Track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place.
Does our site allow third-party behavioral tracking?
It's also important to note that we do not allow third-party behavioral tracking
COPPA (Children Online Privacy Protection Act)
When it comes to the collection of personal information from children under the age of 13 years old, the Children's Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, United States' consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children's privacy and safety online.
Fair Information Practices
The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.
In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:
We will notify you via email
• Within 1 business day
We will notify the users via in-site notification
• Within 1 business day
Contacting us
If you have any questions about this Privacy Policy, the practices of this site, or your dealings with this site,
please contact us at: Cando Asia Consulting Co., Ltd.
Cando Asia Consulting Co., Ltd.
243/7-8 Moo 10 Nongprue Banglamung, Pattaya
Chonburi
rune@candoproperty.com
We, Cando Asia Consulting Co., Ltd., provide this privacy notice to inform our customers of our policy in relation to the collection, use and disclosure of personal data of individual (“you”) in accordance with the Personal Data Protection Act B.E. 2562 (“PDPA”), relevant laws and regulations. This privacy notice informs you of how we collect, use or disclose your personal data, what and why we collect, use or disclose your personal data, how long we hold it, who we disclose it to, your rights, what steps we will take to make sure your personal data stays private and secure, and how you can contact us.
This privacy notice applies to:
(1) Our customers
- Individual customers: Our past and present customers who are individual.
- Corporate customers: Directors, shareholders, ultimate beneficial owners, employees, guarantors, security providers, and legal representatives of our past and present corporate customers and other individuals authorised to act on their behalf. Our corporate customer shall ensure that the authorised persons and any of relevant individuals have acknowledged our privacy notice.
(2) Non-customers
These include individuals who have no product or service holding with us, but we may need to collect, use or disclose your personal data, e.g. investors; anyone who makes a payment to or receives a payment from our customers; anyone that visits our website or our applications, branches or offices; guarantors or security providers; ultimate beneficial owner; directors or legal representatives of a company that uses our services; debtors or tenants of our customers; professional advisors, including our directors, investors, shareholders and their legal representatives, and anyone involved in other transactions with us or our customers.
Please note that some of the links on our platform may lead to third party’s platforms, and if you access these platforms, your personal data will then be processed under the third party’s policies. Make sure that you have read those privacy notices when accessing such platforms.
1.How we collect, use or disclose your personal data
We only collect, or disclose use your personal data where it is necessary or there is a lawful basis for collecting, or disclosing using it. This includes where we collect, use or disclose your personal data based on the legitimate grounds of legal obligation, performance of contract made by you with us, our legitimate interests, performance under your consent and other lawful basis. Reasons for collecting, using or disclosing are provided below:
1.1. Our legal obligation
We are regulated by many laws, rules, regulations, and orders of any competent governmental, supervisory or regulatory authorities, and to fulfil our legal and regulatory requirements, it is necessary to collect, use or disclose your personal data for the following purposes, which include but not limited to:
a) Compliance with the PDPA and any amendment thereof;
b) Compliance with laws (e.g. Digital Asset Laws, Securities and Exchange Laws, Anti-Money Laundering Laws, Prevention and Suppression of Financial Support to Terrorism and the Proliferation of Weapons of Mass Destruction Laws, and other laws to which we are subject both in Thailand and in other countries), including conducting identity verification, background checks and credit checks, Know Your Client/Customer Due Diligence (KYC/CDD) processes, other checks and screenings (including screening against publicly available database of regulatory authorities and/or official sanctions lists), and ongoing monitoring that may be required under any applicable law; and/or
c) Compliance with regulatory obligations and/or orders of authorized persons (e.g. orders by any court of competent jurisdiction or of governmental, supervisory or regulatory authorities or authorized officers).
1.2. Contract made by you with us
We will collect, use or disclose your personal data in accordance with the request and/or agreement made by you with us, for the following purposes, which include but not limited to:
a) process your request prior to entering into an agreement, consider for approval in relation to the provision of products and/or services, and deliver our products and/or services to you including any activities that if we do not proceed, then our operations or our services may be affected or may not be able to provide you with fair and ongoing services;
b) authenticate when entering into, doing or executing any transactions;
c) carry out your instructions (e.g. to debit or credit amounts from accounts or respond to your enquiries);
d) provide online services, mobile applications and other online product platforms;
e) track or record your transactions;
f) produce reports (e.g. transaction reports requested by you or our internal reports);
g) notify you with transaction alerts; and/or
h) recover the money which you owe (e.g. when you have not paid for your debt and/or outstanding fees).
1.3. Our legitimate interests
We rely on the basis of legitimate interests by considering our benefits or third party’s benefits with your fundamental rights in personal data which we will collect, use or disclose for the following purposes, which include but not limited to:
a) conduct our business operation and our financial business group companies’ business operation (e.g. to audit, to conduct risk managements, to monitor, prevent, and investigate fraud, money laundering, terrorism, misconduct, or other crimes, including but not limited to carrying out the creditworthiness checks of any persons related to our corporate customer);
b) conduct our relationship managements (e.g. to serve customers, to conduct customer survey, to handle complaints);
c) ensure security (e.g. to maintain CCTV records, to register, exchange identification card and/or take photo of visitors before entering into our building);
d) develop and improve our products, services and, systems to enhance our services standard and/or for the greatest benefits in fulfilling your needs, including to conduct research, analyse data and offer products, services and benefits suitable to you by considering the fundamental rights in your personal data. If you do not wish to receive the offering of products, services and benefits from us, you can contact us through our Data Protection Officer by email DPO@candoconsult.com
e) record images and/or voices relating to the meetings, trainings, seminars, recreations or marketing activities; and/or
f) in case of our corporate customer, we will collect, use and disclose personal data of directors, authorized persons or attorneys.
1.4. Your consent
In certain cases, we may ask for your consent to collect, use or disclose your personal data to maximise your benefits and/or to enable us to provide services to fulfil your needs for the following purposes, which include but not limited to:
a) collect and use your sensitive personal data as necessary (e.g. to use face recognition or your identification card photo (which contains your sensitive personal data, namely religion and/or blood type) for verification of your identity before continuing the transaction);
b) collect and use your personal data and any other data to conduct research and analyze for the greatest benefits in developing products and services to truly fulfil your needs and/or to contact you for offering products, services and benefits exclusively suitable to you;
c) send or transfer your personal data overseas, which may have inadequate personal data protection standards (unless the PDPA specifies that we may proceed without obtaining consent); and/or
d) when you are classified as a minor, incompetent or quasi-incompetent whose consent must be given by their parent, guardian or curator (as the case may be) (unless the PDPA specifies that we may proceed without obtaining consent ); and/or
e) disclose your personal data and any other data to our business group companies as shown on and our trusted business partners for the following purposes: (1) conducting research and analyzing your personal data and any other data for the greatest benefits in developing products and services to truly fulfil your needs; and (2) contacting you for offering products, services and benefits exclusively suitable to you.
1.5. Other lawful basis
Apart from the lawful basis which we mentioned earlier, we may collect, use or disclose your personal data based on the following lawful basis:
a) prepare historical documents or archives for the public interest, or for purposes relating to research or statistics;
b) prevent or suppress a danger to a person’s life, body or health; and/orc) necessary to carry out a public task, or for exercising official authority.
If the personal data we collect from you is required to meet our legal obligations or to enter into an agreement with you, we may not be able to provide (or continue to provide) some or all of our products and services to you if you do not provide such personal data when requested.
2.What personal data we collect, use or disclose
The type of personal data, namely personal data and sensitive personal data, which we collect, use or disclose, varies on the scope of products and/or services that you may have used or had an interest in. The type of personal data shall include but not limited to:
|
Category
|
Examples of personal data
|
|
Personal details
|
● Given name, middle name, surname, hidden name (if any)
● Gender
● Date of birth
● Age
● Educational background
● Marital status
● Nationality
|
|
Contact details
|
● Mailing address
● E-mail address
● Phone number
● Facsimile Number
● Name of representatives or authorised persons/directors acting on behalf of our customers
● Social media accounts
|
|
Identification and authentication details
|
● ID card photo
● Identification number
● Passport information
● Driving license
● Signatures
|
|
Employment details
|
● Occupation
● Employer’s details
● Position
● Salary or income
● Remuneration
|
|
Financial details and information about your relationship with us
|
● Products and/or services you use
● Channels you use and ways you interact with us
● Your customer status, your ability to get and manage credit, your payment history, transaction records
● Information about your transactions, (e.g. type, number, and other information relating to your transactions)
|
|
Market research, marketing and sales information
|
● Customer survey
● Information and opinions expressed when participating in market research
● Details of services you receive and your preferences
|
|
Geographic information and information about your device and your software
|
● Your GPS location
● IP address
● Technical specifications and uniquely identifying data.
|
|
Investigation data
|
● Data for due diligence checks (e.g. information related to Know Your Client (KYC) or Customer Due Diligence (CDD))
● Data for risk management or Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) checks
|
|
User login and subscription data
|
● Login information for using our system, online internet transaction, and applications.
|
|
Information concerning security
|
● Visual images
● Personal appearance
● Detection of any suspicious and unusual activity
● CCTV images or recordings
● Video recordings
|
|
Sensitive personal data
|
● Biometric information, (e.g. face recognition, fingerprint, voice recognition and retina recognition)
|
|
Other information
|
● Records of correspondence and other communications between you and us, in whatever manner and form, including but not limited to phone, email, live chat, instant messages and social media communications
● Information about insurance policy and claim for compensation (e.g. policy coverage, medical records, insurance claims history)
● Information that you provide to us through any channels
|
3.Sources of your personal data
Normally, we will collect your personal data directly from you, but sometimes we may get it from other sources, in such case we will ensure the compliance with the PDPA.
Personal data we collect from other sources may include but not limited to:
a) Information obtained by us from financial business group companies, business partners, and/or any other persons who we have relationship with;
b) Information obtained by us from persons related to you (e.g. your family, friends, referees);
c) Information obtained by us from corporate customers as you are director, authorised person, attorney, representative or contact person;
d) Information obtained by us from governmental authorities, regulatory authorities, financial institutions, credit bureau and/or third-party service providers (e.g. information that is publicly available, or that relates to transactions, credit information); and/or
e) Information obtained by us from insurance companies and/or other persons in relation to insurance policy or claim for compensation.
4.Your rights
The PDPA aims to give you more control of your personal data. You can exercise your rights under the PDPA upon the effectiveness of the provisions in relation to rights of data subjects, details are as follows:
4.1 Right to access and obtain copy
You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.
4.2 Right to rectification
You have the right to rectify your inaccurate personal data and to update your incomplete personal data.
4.3 Right to erasure
You have the right to request us to delete, destroy or anonymise your personal data, unless there are certain circumstances where we have the legal grounds to reject your request.
4.4 Right to restrict
You have the right to request us to restrict the use of your personal data under certain circumstances, e.g. when we are pending examination process in accordance with your request to rectify your personal data or to object the collection, use or disclosure of your personal data, or you request to restrict the use of personal data instead of the deletion or destruction of personal data which is no longer necessary as you have necessity to retain it for the purposes of establishment, compliance, exercise or defense of legal claims).
4.5 Right to object
You have the right to object the collection, use or disclosure of your personal data in case we proceed with legitimate interests basis or for the purpose of direct marketing, or for the purpose of scientific, historical or statistic research, unless we have legitimate grounds to reject your request, e.g. we have compelling legitimate ground to collect, use or disclose your personal data, or the collection, use or disclosure of your personal data is carried out for the establishment, compliance, or exercise legal claims, or for the reason of our public interests.
4.6 Right to data portability
You have the right to receive your personal data in case we can arrange such personal data to be in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means. Also, you have the right to request us to send or transfer your personal data to third party, or to receive your personal data which we sent or transferred to third party, unless it is impossible to do so because of the technical circumstances, or we are entitled to legally reject your request.
4.7 Right to withdraw consent
You have the right to withdraw your consent that has been given to us at any time pursuant to the methods and means prescribed by us, unless the nature of consent does not allow such withdrawal. The withdrawal of consent will not affect the lawfulness of the collection, use, or disclosure of your personal data based on your consent before it was withdrawn.
4.8 Right to lodge a complaint
You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA.
5.How we share your personal data
We may disclose your personal data to the following parties under the provisions of the PDPA:
a) our financial business group companies, business partners and/or other persons that we have the legal relationship, including our directors, executives, employees, staffs, contractors, representatives, advisors and/or such persons’ directors, executives, employees, staffs, contractors, representatives, advisors;
b) governmental authorities and/or supervisory or regulatory authorities, (e.g. the Bank of Thailand, the Securities and Exchange Commission, Office of Insurance Commission, Ministry of Digital Economy and Society);
c) suppliers, agents and other entities (e.g. professional associations to which we are member, external auditors, depositories, document warehouses, overseas financial institutions, clearing houses) where the disclosure of your personal data has a specific purpose and under lawful basis, as well as appropriate security measures;
d) any relevant persons as a result of activities relating to selling rights of claims and/or assets, restructuring or acquisition of any of our entities, where we may transfer their rights to; any persons with whom we are required to share data for a proposed sale, reorganisation, transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets held by our business;
e) other banks, financial institutions and third parties where required by law to help recover funds that have entered your account due to misdirected payment(s) by such third parties or trace funds where you are a victim of suspected financial crime, or where suspect funds have entered your account as a result of financial crime;
f) debt collection agencies, lawyers, credit bureau, fraud prevention agencies, courts, authorities or any persons whom we are required or permitted by laws, regulations, or orders to share personal data;
g) third parties providing services to us (e.g. market analysis and benchmarking, including but not limited to correspondent, agents and subcontractors acting on our behalf, the companies which print and deliver credit card statements);
h) social media service providers (in a secure format) or other third-party advertisers so they can display relevant messages to you and others on our behalf about our products and/or services. Third-party advertisers may also use information about your previous online activities to tailor adverts to you;
i) third-party security providers;
j) other persons that provide you with benefits or services associated with your products or services (e.g. insurance company); and/or
k) your attorney, sub-attorney, authorized persons or legal representatives who have lawfully authorized power.
6.International transfer of personal data
The nature of the modern cryptocurrency business is global and under certain circumstances it is necessary for us to send or transfer your personal data internationally. When sending or transferring your personal data, we will always exercise our best effort to have your personal data transferred to our reliable business partners, service providers or other recipients by the safest method in order to maintain and protect the security of your personal data, which includes the following circumstances:
a) comply with a legal obligation;
b) inform you the inadequate personal data protection standards of the destination country and obtain your consent;
c) perform the agreement made by you with us or your request before entering into an agreement;
d) comply with an agreement between us and other parties for your own interest;
e) prevent or suppress a danger to your or other persons’ life, body or health and you are incapable of giving consent at such time; or
f) carry out activities relating to the substantial public interest.
7.Retention period of personal data
We will maintain and keep your personal data while you are our customer and once you has ended the relationship with us (e.g. after you closed your account with us, or following a transaction with us, or in case of your application to use our services is disapproved, or you terminated the services provided by us), we will only keep your personal data for a period of time that is appropriate and necessary for each type of personal data and for the purposes as specified by the PDPA.
The period we keep your personal data will be linked to the prescription period or the period under the relevant laws and regulations (e.g. Financial Institutions Businesses Laws, Securities and Exchange Laws, Anti-Money Laundering Laws, Counter-Terrorism and Proliferation of Weapon of Mass Destruction Financing Laws, Accounting Laws, Tax Laws, Labour Laws and other laws to which we are subject both in Thailand and in other countries). In addition, we may need to retain records of CCTV surveillance in our head office, our branches or at ATM machines and/or voice records of Call Center to prevent fraud and to ensure security, including investigating suspicious transactions which you or related persons may inform us.
8.Use of Cookies
We may collect and use cookies and similar technologies when you use our products and/or services. This includes when you use our websites, and applications.
The collection of such cookies and similar technologies helps us recognise you, remember your preferences and customise how we provide our products and/or services to you. We may use cookies for a number of purposes (e.g. enabling and operating basic functions, helping us understand how you interact with our websites or emails, or enabling us to improve your online experiences or our communications with you, particularly, to ensure that online adverts displayed to you will be more relevant to you and of your interests).
9.Use of personal data for original purposes
We are entitled to continue collecting and using your personal data, which has previously been collected by us before the effectiveness of the PDPA in relation to the collection, use and disclosure of personal data, in accordance with the original purposes. If you do not wish us to continue collecting and using your personal data, you may notify us to withdraw your consent at any time.
10.Security
We endeavour to ensure the security of your personal data through our internal security measures and strict policy enforcement. The measures extend from data encryption to firewalls. We also require our staff and third-party contractors to follow our applicable privacy standards and policies and to exercise due care and measures when using, sending or transferring your personal data.
11.How to contact us
If you have any questions or would like more details about our privacy notice or would like to exercise your rights, please contact us through email DPO@candoconsult.com
Alternatively, you can contact our office located at 243/7-8 Moo 10 Nongprue Banglamung 20150 Chonburi Thailand
12.Changes to this privacy notice
We may change or update this privacy notice from time to time and we will inform the updated privacy notice at our websites www.candoproperty.com and www.candoconsult.com
