Privacy Notice

Effective on August 2024

Bank of Ayudhya Public Company Limited and its ﬁnancial group of companies, whose names appear in the attachment to this Privacy Notice, , (collectively, ‘Krungsri Group’ or ‘we’) have recognised the importance of your personal data and have prepared this Privacy Notice (this “Notice”) to inform about Krungsri Group's collection, use, disclosure, or transfer of your personal data including other data relating to you (collectively ‘Data’).

A. To whom does this Notice apply

This Notice applies to third parties that we have relationships with, including the procedures of existing and future transactions with the third parties, whose personal data we collect, use, disclose, or transfer in the course of our normal business or about the products and services we provide (for example, savings account opening service, credit card service, loan service, personal loan service, insurance brokerage service, hire purchase service, leasing service, funds service, securities service) (“Products and Services”), depending on the type of Products and Services that the third parties may apply for or request from Krungsri Group, which includes:

(1) individuals, including business operators who are individuals;

(2) partners and service providers who are individuals;

(3) board of directors, representatives, shareholders, agents, employees, and other persons in a similar capacity (collectively,“Connected Persons”) of:

(a) juristic persons and their afﬁliates which are customers of Krungsri Group including corporate operators;

(b) business partners of Krungsri Group (such as bond issuers, insurance companies, and representatives of ﬁnancial institutions);

(c) partners or service providers which are juristic persons including other juristic persons who offer Products and Services to Krungsri Group;

(d) afﬁliates of Krungsri Group and other juristic person participating or intend to participate in or in relation to any project(s) in which related to investment or business operations including investment partners with afﬁliates of Krungsri Group;

in this Notice, persons described in (b) (c) and (d) are collectively called “Business Partners”,

(4) users and recipients of the Products and Services;

(5) visitors and users of our websites, including mobile applications, computer devices, and other channels of communication; and

(6) any other persons whose personal data we obtain (such as directors, representatives, shareholders, agents, employees and/or any other persons who have the same position in a company where Krungsri Group invests or makes a transaction, shareholders of companies in Krungsri Group and their proxies, individual guarantors and participants in a public auction and questionnaire respondents).

Persons described in (1) to (6) are collectively called “you”.

B. Changes to this Notice

This Notice, including the name list of Krungsri Group companies in the attachment to this Notice, may be amended or updated from time to time. This is to reﬂect changes in our practices or policies with respect to the collection, use, disclosure and/or transfer of personal data, or changes in applicable law. Krungsri Group will notify you of such changes to ensure that you have adequate information on the changes. We also encourage you to read this Notice carefully, and to regularly check and review any changes we might make to this Notice.

C. How we collect, use, disclose and/or transfer and protect your Data

The purpose of this Notice is to describe in detail how we collect, use, disclose, and/or transfer your Data. This Notice informs you the rights and options as a data subject with respect to your Data, and our contact details when you have any inquiries.

1. Personal data that we collect

1.1 Categories of personal data

“Personal data” means any identiﬁable data relating to you. If there is any data which can be combined with your Data, or other data which is used to prepare a proﬁle of an individual, we will deem that such data is personal data.
Krungsri Group may collect or obtain the following categories of data which may include your Personal Data, depending on the context of your relationship with us and the type of data subject you are.

(1) You as an individual

Category of personal data	Description and examples
Name and initials	Your data you are known of, addressed, or referred to such as title, ﬁrst name, initial, middle name, last name, previous last name, aliases or previous names, signature
Personal characteristics	Your personal characteristics such as age, date of birth, gender, height, weight, marital status, number of children, nationality, country of birth, citizenship and status, military details, leisure and interests, photographs, language skills, travel details, voice recording, data about behaviours and preferences of users
Contact details	Your contact details such as home postal address or work address, contact address, home or work telephone and facsimile number, e-mail address, mobile or wireless number, social media proﬁle, household registration, main country of residence, types of residences (e.g., house ownership, welfare housing, house rent and rentals), residences of foreigners in home country, maps showing residences and workplace
Educational details	Your educational and professional details such as degrees and schooling, academic records, licenses, professional membership (e.g., member of the Lawyers Council, member of the Engineering Institute of Thailand and member of the Medical Council)
Employment details	Your employment details, status, and history such as occupation, title, position, function, employer identiﬁcation number, job code, corporate held credit/debit card, work visa status/employment authorization details, reference and background checks (excluding criminal records), taxpayer identiﬁcation number, employee identiﬁcation number, insurance claims, workers compensation claims, employment records (including salary, attendance, and beneﬁts), recruitment date, work termination, assets in possession of the employee, previous workplace, your workplace or places where you are employed or in which you hold shares, reviews (e.g., potential and performance reviews) including technological evaluation and the use of technology (e.g., internet, email)
Government-issued identiﬁcation details	A number or details given to you by competent authority to identify who you are such as national identiﬁcation number, driver's license number, operation's license number, vehicle registration number, professional license number, passport number, foreigner registration number, house registration details, social security number and any other identiﬁcation numbers issued by the government
Financial and transaction details	Financial and transaction details such as • information relating to background checks, ﬁnancial institution account number, name of ﬁnancial institutions (including credit card companies), ﬁnancial transaction history, credit history, banking details, investments, savings, insurance claim history, income/salary/service fees/other compensations, compulsory employee salary deductions, voluntary employee salary deductions, ﬁnancial assistance (e.g., beneﬁts, assistance, allowances, subsidies), household income data; • source of income, size/component of household, data relating to vehicles or assets, bonus, details which appear in domestic income statement, records of assets, photography of assets taken during site inspection, maximum limit of guarantee and number of installments, country of source of income, cash ﬂow in bank accounts, certiﬁcates from banks, credit limits, bank guarantees, details about debts, objectives of bank account opening, sources of deposits, ﬁnancial statements, objectives of business relationship or transactions, investments, and deposits; • data relating to ﬁnancial literacy and suitability, experience and knowledge relating to investment and transaction; • total asset details, length of residing in current residence, ﬁnancial obligations relating to your current residence/vehicle as described in vehicle registration manual; • collaterals, your details of obligation with other parties, both as lenders and debtors, as well as details in acquired and sold collaterals including movable and immovable properties, including titles and valuations of the collaterals; • purpose of loan application, down payment, down payment period, loan limit, interest rate; • transactional information and history such as your purchase history (e.g., purchase/lease/return of goods, products and services, rentals, and returns), address for sending bills and statements, information contained in invoices, instruction records, transaction details and counterparty details; • insurance-related information such as existing insurance premiums, insurance coverage, insurance claim history, policy number for compulsory third-party insurance; • locational information such as map showing location of your home/ workplace/collateral, image showing location of business operating place, housing records (e.g., household registration)
Credit/ debit card details	Your credit card details such as number of credit cards you hold, credit card/debit card number, cardholder name, expiration date, CVV, CVC2, CID number, PIN number, sort code, issuance date, issuing banks, types of credit card
Insurance policy details	Your data related to pre-existing and current insurance including related terms and conditions such as insurer, policy number, policy type (e.g., life insurance, health insurance, automotive insurance, property insurance, travel insurance, and business insurance), coverages, limits, exposure, claims-related data, data related to insured property (e.g., house and vehicle), driving data, price and quantity, insurance policy number, broker number, conditions (if any), payment and transaction records relating to the client's insurance policy, ﬁnancial statements, taxes, revenues, income, and default record
Social relationship details	Your social relationship details such as political status, relationship with directors, management, and persons with controlling power of Krungsri Group, relationship with other juristic persons (e.g., directorship, management, shareholding), and other relationships
Segmentation attributes details	Segmentation attributes details such as household age indicator, designated market area code, estimated income identiﬁed, number of persons in the household, number of cars owned, college education, dwelling type and number of audiences
Products and Services details	Details about Products and Services which we provide to you such as • details relating to account activation, your contact details in relation to Products and Services (including notiﬁcation details of changes, updates, modiﬁcations or other alterations of the Products and Services, details relating to follow-ups on transaction matters and notiﬁcations on renewal of insurance products), details relating to the issuance and delivery of an account, card, check, certiﬁcate or other document related to the Service in any form to you, details relating to the provision of ongoing Products and Services, (e.g., card renewal, loan maintenance service, insurance policy maintenance service, mutual fund trading service, change to securities, management of inherited securities), details relating to the provision of redemption service (e.g., collateral, securities), details needed for closing the accounts, and other data in relation with the termination of the Products and Service provided to you; • details of forms and application documents for account opening (e.g., details about mutual fund account opening applications and details relating to transactions of mutual funds, tax deductions of dividends, objectives of mutual fund account opening, and details contained in mutual fund subscription forms including unitholder numbers, subscription date, names of funds, subscription amounts, cheque numbers), membership number (e.g., provident fund membership), types of services (e.g., mutual fund services), number of investment units, details of transfer (e.g., funds for which the transfer is applied and the amount of investments to be transferred), any information on the investment risk proﬁling questionnaire (including an investment knowledge, risk tolerance, experience in securities investment, investment plans and views); • instruction records (such as trading orders), application number, extended guarantee, the timeframe within which you agree to allow Krungsri Group to contact you, communication channels, branch codes, campaign codes, details of insurance companies, data relating to insurance, withholding tax, cash payment of purchase price, down payments, investments, objectives of loan application, ﬁnance, credit limits, interest rate, payment installments, payment date for ﬁrst installment, delivery fees, taxes, and applicable tax rates; • data relating to shareholders such as changes in a share certiﬁcate, and the request to exercise the right as a shareholder such as the right to attend a shareholder meeting, the right to receive a dividend; • any data which you have given as a part of our Products and Services or relationship management
Vehicle or collateral details	Details about your vehicles or collaterals such as appraised price/estimate evaluation cost, vehicle brand, model, manufactured year, year of registration, license plate number, province of registration, chassis number, engine number, miles record, any attached obligation to vehicles, and/or other details in accordance with the registration document (e.g., engine power/CC), certiﬁcate of ownership or land ownership (e.g., land title deed, buy and sale agreement, etc.)
Online usage details including technical data and data collected via devices	Details about the use of online and technical data and data collected via devices such as • geo-location, audio/video/photos/camera access data, calendar information, call logs, contact/address book, text messages or emails (content), unique device identiﬁer (UDID), IP address; clickstream/online website tracking, browsing history, types of website visits, data relating to browsing activities such as content visited, links that you click and features used, time and frequency with which you have used online services of Krungsri Group, number of website visits (this applies even if we do not know the identity of the end user), cookies or other similar technologies, language used in visiting websites; • login credentials, security code, access code, or password, account usernames, account passwords, PIN number, access details and time, Single Sign-on (SSO) details, OTP, Token, SMS messages; • telemetry , metadata, data related to end user activity device numbers and types, networks, connection details, access details, plug-in types of browsers including versions, operating systems, platforms, time zone setting and locations, time used in accessing website; • data relating to the means that you use in interacting with online services or advertisements of Krungsri Group, website pages, time and frequency which you have used the online services of Krungsri Group (e.g., Referrer URL), crash report, and other technologies on communication devices that you use for accessing the platforms; • unstructured data, RFID, models of communication devices, content in MID device (e.g., LINE generated ID which is not LINE ID), codes for your survey response submitted via LINE, LINE ID, Rabbit ID, social media account ID (e.g., Google, Facebook)
Behaviours, preferences, views, inquiries, and opinions details	Details relating to behaviours, preferences, views, inquiries, and opinions such as data relating to the use of Products and Services that you are interested in, other information that you choose to send to us (including on or via social media platforms or online surveys), comments, feedback, complaints, recommendations, survey responses, inquiries, and any data you have voluntarily given during marketing or customer service-related communications, including your Data that is disclosed on your social media proﬁles
Data in compliance to FATCA (Foreign Account Tax Compliance Act) of the United States of America and and ROYAL DECREE: The Exchange of Information for the Implementations Under the International Agreement on Taxation (Common Reporting Standard: CRS)	Data in compliance to FATCA such as whether you have the nationality or birthplace that is linked to the United States of America, whether you have legally surrendered American citizenship, you hold an American Permanent Resident Card, you have an obligation to pay tax to the American Revenue Department, you have a current U.S. residence address, U.S. mail address, or U.S. telephone number for contacting you or another person related to the account opened or held with Krungsri Group. Information relating to the account owner, such as name, address, taxpayer identification number, date, month, year of birth, and place of birth, and financial account information, such as account number, or balance in the account.
Provision of Products and Services details including our interaction with you	Provision of Products and Services details including our interaction with you such as telephone conversation logs between you and Krungsri Group, voice records, call notes (open text ﬁelds), co-pay/ ﬁnancial assistance, terminal ID, data which is subject to litigation holds or eDiscovery, data to be retained for litigation purposes
Sensitive personal data	Sensitive personal data such as criminal records, religion data, disabili- ty data, biometric data (such as facial and ﬁngerprint data) Krungsri Group may collect your sensitive personal data described above for purposes described in 2.3 “Sensitive Personal Data”.

(2) You as a Connected Person

Category of personal data	Description and examples
Identity data	Your identity data such as ﬁrst name, middle name, last name, age, employment information, government-issued ID numbers (e.g., national ID number, driver's license number, ID for professional licenses, passport number, foreigner registration number, tax identiﬁcation number, social security number), work-related information (e.g., position, function, occupation, job title, company you work for, are employed or hold shares of), nationality, and signature
Contact data through different channels	Your contact data through different channels such as phone number, email address, social media account ID, chat ID, address

Category of personal data

Description and examples

Identity data

Your identity data such as ﬁrst name, middle name, last name, age, employment information, government-issued ID numbers (e.g., national ID number, driver's license number, ID for professional licenses, passport number, foreigner registration number, tax identiﬁcation number, social security number), work-related information (e.g., position, function, occupation, job title, company you work for, are employed or hold shares of), nationality, and signature

Contact data through different channels

Your contact data through different channels such as phone number, email address, social media account ID, chat ID, address

If you do not provide your Data, Krungsri Group may not be able to provide you with the Products and Services you request or may not meet our certain obligations to you, or we cannot comply with our legal obligations.

Personal data of third parties

You are responsible for notifying third parties of the details of this Notice, and obtaining any required consent from them (where consent is required) if you give us their personal data. In addition, you must also ensure that we can lawfully collect, use, disclose, or transfer those third parties' personal data as set out in this Notice depending on the companies in Krungsri Group that you have interacted with and gave their Data to. Examples of personal data includes:
• name, family name, age, gender, postal/email address, telephone number, identiﬁcation number, passport number;
• ﬁnancial documents, salary, work-related information (e.g., position, function, occupation, job title, company he/she works for, is employed at, or holds shares of);
• relationship with director of, management of and a person having controlling power over Krungsri Group, relationship with other corporate entities (e.g., as a director, management and shareholder), information of persons with the controlling power of funds including the assignees, beneﬁciaries, information of ultimate beneﬁciary owners, company's board/ directors/shareholders/representatives of juristic person/chief managers, other persons who can dictate policies or possess executive power in an organization;
• relationship with you and political status such as relatives who hold political status;
• your family members, joint account holders, spouse/former spouse, data relating to your children (such as their titles, name, family name, age, gender, government-issued identiﬁcation number, address, e-mail address and activities relating to them), next of kin, housing ownership;
• estate administrator/executor’s information, joint account holders’ information, information of witness, information of the assignee of the power of attorney;
• authorized person, information relating to witnesses and assignees under a Power of Attorney, contact person, insurance premium payer, authorized signatory/withdrawer of deposit account, guarantors, reference person, customers of the third parties;
• pledgers/pledgees, mortgagers/mortgagees, lessors/lessees, registrars for property being placed by you as collateral, your debtors, transferee/recipient of the funds, the payee, employer;
• contact person for debt collection, or you ask us to disclose their personal data to other third parties;
• in some cases, we may have inevitably received or accessed personal data about other persons through other sources, such as via Single Form on KSAM's FundConnext platform , in which we do not require such personal data in offering our Products and Services.

Personal data of minors, incompetent persons, and quasi-incompetent persons

If Krungsri Group has acknowledged that we need to obtain consent from data subjects who are minors and cannot lawfully give consent by themselves, we will not collect their Data until the consent of the persons exercising parental power is obtained. In addition, we will not collect any Data from quasi-incompetent persons or incompetent persons until the consent of their legal curators and guardians is obtained (as the case may be).

If Krungsri Group has not acknowledged that the data subjects are minors, quasi-incompetent persons or incompetent persons prior to the collection of their personal data, upon learning that we have collected personal data of minors without the consent of persons exercising parental power (when it is required and the minors cannot lawfully give consent by themselves), or from quasi-incompetent persons and incompetent persons without the consent of their legal curator and guardian, we will delete the personal data at the earliest convenience unless we can rely on other legal bases apart from consent.

Cookies

As part of the security procedure for our services and user experiences in using our Products and Services, cookies and such other systems may be used and may be placed on your device, depending on the company in Krungsri Group that you have interacted with. In general, information gathered using cookies is not linked to any identiﬁable data (e.g., your name or e-mail). However, if we may need to link your personal data with cookies or other data that is associated with your use of our Products and Services, we will treat cookies and combined data as personal data.

1.2 Collection of your Data

Krungsri Group may collect your Data in various ways (depending on the company in Krungsri Group that you have interacted with), including:

(1) Through the service channels: we may collect your Data directly from you both via online and ofﬂine channels (e.g., via branches or ofﬁces of Krungsri Group, interviews, post, ATMs, messengers) or via telecommunications such as telephones, e-mails, websites, applications, Krungsri Internet Banking Laos (KIBL), online social network platforms (e.g., Line and Facebook), and other promotional and marketing channels.

(2) From sources other than through the service channels: we may collect your Data from other sources such as when you contact Krungsri Group before carrying out transactions, applying for Products and Services of Krungsri Group, requesting for pitching documents or proposals, participating in transactions or entering into contracts (regardless of the channels through which the contacts are made and personal data is given such as through Krungsri Group branches, electronic platforms, online social networks, Krungsri Group’s ofﬁcial LINE account) or data obtained from the data room relating to transactions.

(3) Other sources: we may collect your Data from other sources such as public sources and/or through our parent company and afﬁliates (e.g., service providers engaged by us to collect personal data on our behalf), our Business Partners (such as co-branded companies, or companies participating or intend to participate in projects in or in relation to investment or business operations with afﬁliates of Krungsri Group, or insurance companies for insurance related purposes or FundConnext platform), the entities to which we invest or make a transaction, the entities to which we provide the Services (including their websites, online social networking proﬁles), government sources, government agencies holding a reliable database of individuals, government authorities (e.g., the Bank of Thailand, the Revenue Department, the Anti-Money Laundering Ofﬁce, the Ofﬁce of Insurance Commission, the Legal Execution Department, the Ministry of Commerce, the Ofﬁce of Securities and Exchange Commission, the Department of Lands,), courts, and from other third parties (e.g., referral persons, your representatives or other parties who are persons who were ultimately given 5ower of attorney from you).

2. Legal bases and why we collect, use, disclose, or transfer your Data

2.1. Legal bases we may rely on

Krungsri Group will determine our legal bases for the collection, use, disclosure, or transfer of your Data, as appropriate, depending on the company in Krungsri Group that you have interacted with. In most cases, the legal bases which we mainly rely on are any of the following:

Legal bases	Description
Contractual basis	To allow us to perform obligations and/or actions that are necessary for entering into contract with you and/or for providing you with the Products and Services you require under the contracts between you and Krungsri Group (for example, to allow you to make and receive payments using a credit card issued by us, to lend you the amount of money based on your loan contract with us, to assist you with payments relating to insurance policies, etc.), and to perform obligations under contracts.
Legal obligations	To allow us to meet our legal obligations (for example, obtaining proof of your identity to meet our obligations under anti-money laundering laws of Krungsri Group and disclosing to the National Credit Bureau (NCB) per our obligations under the credit information laws and the Foreign Account Tax Compliance Act: FATCA).
Legitimate interests	To pursue our and others’ legitimate interests (such as to understand how customers use our Services and develop new services, to improve to be new services we currently provide, to run a sales promotion or publicize Products and Services including beneficial privileges that are on your expectation and processing it within each entity of Krungsri Group, to detect and prevent fraud), to administer systems and services for collection and write-off management.
Vital interest	To prevent or suppress a danger to your life, body, or health.
Consent	To collect, use, disclose, or transfer your Data if your consent is required, such as for promoting sales or publicizing the Products and Services including beneﬁcial privileges. and we cannot rely on another lawful basis.

If Krungsri Group is required to collect your Data for fulﬁlling contractual or legal obligations, Krungsri Group may not provide you with the requested services or take the requested steps and you do not provide us with your Data.

2.2. The purposes for which we collect your Data

Krungsri Group have collected your Data for various purposes, depending on the company in Krungsri Group that you have interacted with or entered into transactions with, Products and Services you have obtained from us, including the nature of relationships between you and our Business Partners and/or any other consideration in each speciﬁc context. Kindly note that the purposes listed below only set out the general framework of the use of Data by Krungsri Group on the date that this Notice has been prepared and only purposes relating to you will be applicable.

(1) Pre-enrollment and customer onboarding

Purposes	Description
Identiﬁcation and veriﬁcation	To conduct your identity and signature veriﬁcation, such as when you apply for the Products and Services of Krungsri Group or our afﬁliates/ Business Partners or when entering into agreements and transactions with you, to enable you to apply for and obtain the Products and Services, to verify your login credentials, to verify your location for allowing you to access your accounts or to conduct online transactions by using provided channels, to create your electronic signature, to verify your identity when you contact us for requesting to obtain customer-related Products and Services through the provided channels (such as branches of Krungsri Group, telephone, e-mail, LINE account, mobile application and website), and to compile security questions for identity veriﬁcation processes.
Quotation and onboarding	To provide you with insurance premium quotation and process quotation or proposals about Krungsri Group’s Products and Services that you may be interested, apply, or requested for, to process quotation, registration, and applications for customer on-boarding, to assist you in applying for and receiving Products and Services.
Eligibility assessment, approval, and rejection	• To assess your application, request, and eligibility in requesting Products and Services, to conduct initial customers’ background checks, to fully check qualiﬁcations for requesting Products and Services, to assess risks and process the eligibility assessment procedures by considering background information for proposing, considering, and approving Products and Services which you have applied or requested for, to verify relevant documents received by Krungsri Group (such as customer data and assessment of acceptable risk, corporate documents and the updated list of shareholders); • To offer an appropriate insurance policy or insurance premium, to prepare an insurance policy, to extend the warranty; • To analyse credit risk, to conduct credit checking, to prepare credit scoring / model, to create credit assessment models in order to assess your credit reliability, to check your credit status, to evaluate collaterals by way of site visits or to investigate facts relating to assets and asset seizure; • To Create a model to analyze the ability to pay for basic goods or services. It takes data from customers to develop a mathematical model. Including calculation formulas that are necessary to analyze the ability to pay for basic goods or services. This mathematical model will be provided to the bank's alliances to be a part of the alliance's service decisions. • To appraise collaterals for mortgaged loans, to approve or reject your request for obtaining services, to approve collaterals for Products and Services, to contact you in relation to Products and Services you have requested or applied for (such as in the case that we have been contacted by you to ask whether your request is approved or rejected); • To allow the Department of Land Transport to inspect and certify vehicles and to inspect status of vehicles and to transfer ownership of vehicles to Krungsri Group which is a step in credit review in case of car reﬁnancing), to register vehicles with the Department of Land Transport (vehicle registration manual)
Due diligence	• To carry out the processes and steps of customer identiﬁcation and other security risk checks (including, “know your customer” (KYC), and other risks and security checks, to verify customer's identity and status, to check the data or to conduct background checks in other ways or to identify risks relating to you and/or customers (such as Know Your Customer (KYC), "customer due diligence" (CDD), anti-money laundering, to conduct Related Parties Transaction (RPT) checks, Foreign Account Tax Compliance Act (FACTA), to check your Data which you provided to Krungsri Group against the blacklist data- base, to conduct other due diligence and veriﬁcation requirements against the public database of law enforcement agencies and/or sanction lists under the law and other relevant lists, including to comply with sanctions, procedures or rules, to verify your relationship with politicians, to carry out ﬁnancial transactions and payment services, including to carry out transaction checks; • To check and assure the documents delivered by you, including the eligibility and qualiﬁcation for obtaining Products and Services, to verify your eligibility for application for obtaining Products and Services of Krungsri Group, such as account opening, loan request, to evaluate your loan information, to inspect the registration manual before a loan can be drawn; • To check the conﬂict and other necessary onboarding and ongoing customer checks; • To carry out tax reporting and regulatory reporting; • To check customer data for the purpose of improving and managing customer data of Krungsri Group's customer to be up to date; • To carry out veriﬁcation and cancellation, to check your account opening documents or to provide Products and Services (such as private funds).
Risk assessment and management	• To assess risks based on your proﬁle and information obtained to determine eligibility for Products and Services, to evaluate your application or eligibility for Services and to conduct an on-going risk assessment; • To carry out your risk proﬁling based on determined criteria (such as sanction list, bankruptcy record); • To deal with active intra-group risk management pursuant to which risks in terms of markets, credit, default, processes, liquidity, and image, as well as operational and legal risks must be identiﬁed, limited, and monitored; • To carry out risk management of the group companies in compliance with the rules and regulations of The Japanese Financial Service Agency (JFSA) regulated over the parent companies overseas and in compliance with the rules of the Basel Committee on Banking Supervision (BCBS)
Selection of Business Partners and Partners	To carry out due diligence and verify on you and status of Business Partners and partners, other due diligence (Business Partner Due Diligence / Third Party Due Diligence / Know Your Third Party) and/or background check or to identify risks relating to you and Business Partners and partners (such as Know Your Third Party (KYTP), Third Party Due Diligence, anti-money laundering, to conduct Related Parties Transaction (RPT) checks, Foreign Account Tax Compliance Act (FACTA), to check your Data which you provided to Krungsri Group against the blacklist database, to conduct other due diligence and verification requirements against the public database of law enforcement agencies and/or sanction lists under the law and other relevant lists, including to comply with sanctions, procedures or rules, to verify your relationship with politicians, to carry out financial transactions and payment services, including to carry out transaction checks), to assess eligibility and qualifications of you, Business Partners, partners, and personnel in working for Krungsri Group, requesting for quotations or participating in a bidding process, due diligence on documents received by Krungsri Group (such as company’s affidavit, updated list/ identification card of shareholders and the authorized director of the Company), registration of, negotiation of and entering into contract or transaction with you, partners and/or Business Partners.

(2) Providing and managing the Products and Services

Purposes	Description
Provision of the Products and Services	To perform obligations under our agreements such as to perform the following purposes: • to contact and communicate with you about the Products and Services: to provide customer services and support in connection with the Products and Services at the request of customers (e.g., to sign an agreement with you, to approve data relating to credits and to notify you of the details of credits and repayment conditions, to follow up on leasing/hire purchase agreements, to offer Products and Services relating to insurance (e.g., Compulsory Third Party Insurance, Payment Protection Insurance (PPI), to request for additional documents, to renew insurance policies, and tax for use of vehicles, to provide infor- mation about invoices, receipts, results of your application for the Services), to initiate the Services (e.g., to notify you of the account opening and activation, to notify you of the account activation), to provide assistance and interact with you regarding the Products and Services (e.g., responding to your inquiries in relation to the payment channels), to contact you via SMS, to carry out your request when you apply for products or services from our afﬁliates, MUFG Bank, Ltd.’s afﬁliates and/or our business partners; • to issue or deliver relevant documents: to issue and deliver accounts, cards, cheque, certiﬁcates, and welcome pack, or other documents related to the Products and Services in any form to you, to notify customers of the effective date of the insurance and/or such other information relating to insurance, to publish and deliver documents (e.g., contracts, welcome letter, notices from the National Credit Bureau, payment forms, receipts, vehicle tax signs, insurance policies and/or such other relevant documents, to issue and deliver notices or documents and/or documents/notices relating to investments (e.g., certiﬁcates for customers, notice informing results of suitability test, to issue letters of certiﬁcation or conﬁrmation, contracts and reports), to follow up on mail delivery, to provide technical support and solutions, to perform duties of relevant business units (e.g., to issue a contract, to draw loans, and to repay loans); • to take steps in relation to vehicles for certain services such as leasing / hire-purchase, auto loans, to verify and evaluate price and value of vehicles, to process top-up, to register transfer of ownership in vehicles, to check and certify vehicles at the Department of Land Transport, to return registration documents upon termination of contracts; • to provide services relating to funds, to put in place registration and management products or Services, including cases involving government agencies, to notify you when your account is opened and activated, to perform contractual obligations of Krungsri Group and the requested transactions of buy, sell, exchange, and transfer investment unit according to your orders or other relevant activities, to take steps according to an application for products or Services such as mutual fund services, online registration/registration on mobile phones, and account debt application, to approve registration of direct debit/credit, to give advice on funds, to carry out risk ratings, to give notiﬁcations and additional notiﬁcations about mutual funds’ risks, to manage relationships and actions that are necessary for the offering of Products and Services, and to present information that is necessary for investment decisions, to communicate with you about Services, and to inform you about details relating to transactions (e.g., the successful establishment of a fund, the deposit of money into the funds, redemptions, dissolution of funds), including information on current status of funds’ operations and monthly/ quarterly/annual market conditions or as you may request, to hold an annual general meeting to comply with the funds’ regulations or applicable laws and requirements, to organise seminars and training on products or Services of Krungsri Group, to coordinate with third parties (e.g., custodians, trustees of mutual funds, sub-managers), to provide services and activities relating to Products and Services of Krungsri Group • to provide services relating to funds, to put in place registration and management products or Services, including cases involving government agencies, to notify you when your account is opened and activated, to perform contractual obligations of Krungsri Group and the requested transactions of buy, sell, exchange, and transfer investment unit according to your orders or other relevant activities, to take steps according to an application for products or Services such as mutual fund services, online registration/registration on mobile phones, and account debt application, to approve registration of direct debit/credit, to give advice on funds, to carry out risk ratings, to give notiﬁcations and additional notiﬁcations about mutual funds’ risks, to manage relationships and actions that are necessary for the offering of Products and Services, and to present information that is necessary for investment decisions, to communicate with you about Services, and to inform you about details relating to transactions (e.g., the successful establishment of a fund, the deposit of money into the funds, redemptions, dissolution of funds), including information on current status of funds’ operations and monthly/ quarterly/annual market conditions or as you may request, to hold an annual general meeting to comply with the funds’ regulations or applicable laws and requirements, to organise seminars and training on products or Services of Krungsri Group, to coordinate with third parties (e.g., custodians, trustees of mutual funds, sub-managers), to provide services and activities relating to Products and Services of Krungsri Group (e.g., mutual fund, private fund, and provident fund management services, amendments to and maintenance of contracts relating to your applications and/or in compliance with the applicable laws and regulations), to maintain your proﬁle, and to evaluate your risk assessment using your risk proﬁle, to appoint sub-managers to perform work overseas or to appoint a custodian or trustees of mutual funds to support Krungsri Group in offering Products and Services, to take steps relating to due cheques, to dissolve funds, to close accounts, to facilitate you when you wish to apply for Products and Services from other third parties, to provide support or to carry out other activities relating to such Products and Services; • to provide services relating to securities and derivatives, providing ﬁnancial planner/advisor, securities brokerage, securities dealing, securities underwriting, mutual fund management, private fund management, investment advisory, securities lending and borrowing, derivatives dealing, derivatives brokerage, derivatives advisory, and derivatives fund management services. Providing investment product and risk mitigation (including third party’s product). Carrying out research, planning and statistical analysis, for example, on your investment limit and investment behaviour, for the purpose of developing our services and products; • to take steps relating to credit cards, Personal loan cards, to consider temporary or permanent increase or decrease credit line, to upgrade or downgrade cards, to review credit limit and to propose new card type; • to take steps relating to rewards, to provide point or reward redemption service in some situations based on ﬁnancial services, customers’ status, particular card, or service type you have subscribed for, to issue and announce rewards/prizes via media or online platforms; • to notify you about renewal of products and services, to offer, and notify about the renewal of Products and Services, card renewal, loan maintenance service; • to take steps relating to insurance policy, to provide insurance policy maintenance service, to renew existing insurance policies, to underwrite insurance, to claim insurance, or to renew insurance terms, the coming into force of the renewed insurance, the issuance of insurance policies, to claim insurance compensation, to prepare documents to be used in claiming for compensation under insurance policies; • to take steps relating to termination of contracts or relationship, to take steps in relation to termination of contracts, deposit account closure, redemption of mortgaged assets, transfer of ownership in collaterals, to provide quotation to customers, to close your account, and to take such other steps to terminate Products and Services to you; • to provide financial advisory services, financial advisory services in relation to equity securities, financial advisory services in relation to debt securities and/or debt securities placement, financial advisory services in relation to merger and acquisition, financial advisory services in relation to project finance arrangement, and other financial advisory services. • to take other steps that are necessary for the Products and Services, such as to facilitate application for insurance and the use of Krungsri Group's Products and Services.
Processing of transactions and/or payments	Processing of transactions and/or payments for the following purposes: • to transfer money or such other beneﬁts (including facilitation of such transfer of money or other beneﬁts), to proceed with payment transactions, to manage and collect fees, taxes, charges, and interest- due on accounts, to calculate and transfer interests and dividends (including facilitation of such transfer); • to disclose information to operators and credit card companies for approval and debiting, to advance debt of cheque accounts, automatic account debit, installment payments; • to process and to take steps according to orders and in connection with payment, remittance and transactions including processes in insurance premium payment, to give barcodes to customers for payment of Products and Services fees and duty stamps, to take steps relating to your payment and to verify completed payments, proceed with recurring payments; • to provide services relating to recurring payments, to calculate interests, fees and taxes, to conduct settlements, billing, refunds, processing, clearing, or reconciliation activities, to issue tax invoices, receipts, and to pay stamp duty, to deliver such documents, to credit your account, reverse payment; • to collect money according to cheques, to restructure or reconcile (such as debt restructuring); • to take steps relating to ﬁnancial records, to deduct insurance premiums from auto loan ﬁnancing limits, to cancel payment, to refund upon Krungsri Group’s refusal to provide you with the Products and Services, to investigate payment from unknown sources; • to issue and send tax invoices, quotations, receipts, and statements; • to carry out credit balance, to process your direct debit application for credit card bill payment, to block or unblock accounts, to reinstate credit cards or suspended accounts; • to process a cancellation, conﬁrmation, to collect, receive and process for insurance premium payment; • to process and pass on your claims or application in case you are our afﬁliate's or business partner's customer or interested in their Products and Services (such as insurance product, mutual funds, debentures, and bonds), to transfer money; • to allocate capital, to carry out transactions (such as to take steps relating to subscription and investment, to redeem and to exchange investment units, to pay dividends and such other distributions)
Debt collection	Proceed with debt collection for the following purposes: • to notify you of payment due date, outstanding balance, interest, charges, to carry out our debt collection and enforcement under contracts, to recover monies, to collect outstanding or overdue payment, to enter into sites for debt collection purposes, to deal with your account in a manner that is most appropriate to your individual circumstances (e.g., debt restructuring), to conduct property tracing activity and attachment, to repossess property, assets under a leasing agreement / hire purchase agreement or assets used as collaterals, to sell debts of customers and to transfer customers’ history to debt purchasers, to reclaim money; • to carry out public auction (such as to inform you about details of the auction (e.g., date, time, place, and third parties carrying out the public auction) and to follow up on and reclaim assets that you have leased under a leasing or hire-purchase agreement, to contact you for redemption of reclaimed assets, to put the reclaimed assets in a public auction, to contact you to increase the opportunity of participating in a public auction for assets reclaimed by Krungsri Group, to withdraw/transfer surplus from public auction or to charge/collect outstanding debt; • to take steps relating to your account as may be appropriate, to contact you for debt collection, to manage/deduct any incentives in relation to your insurance policy
Data modiﬁcation and maintenance	To modify and maintain data for the following purposes: • to enter your information, to manage customer database and other relevant records for Krungsri Group’s Products and Services, to make customers’ records / data up-to-date, accurate and complete, to make copies of documents relating to sources of income, to keep records of business transactions, and to manage and maintain the business of Krungsri Group; • to take other steps to maintain data including restrict data processing procedures, keep records of contracts and other documents referring to you;
Customer care services	To perform customer care services for the following purposes: • to conduct welcome calls, to handle your complaints, to respond to and fulﬁll your inquiries or requests regarding the Products and Services we provide, to accept any comment/complaint, to investigate the issues you face and provide you with solutions; • to administer accounts, to make plans, take steps and manage relationships (contractual) with you; • to provide customer service in relation to lost, broken, or stolen or non-received cards, to suspend and cancel cards, to replace cards, to consider your fee waiving request; • to send gifts or premiums, and other customer service-related activities.
Advertising marketing, communication of news, announcements and other data in relation to Products and Services	To advertise marketing, communicate news, announcements and other data in relation to Products and Services for the following purposes: • to keep you updated on our news, communications, announcements and other forms of information on our existing or new Products and Services and/or those of our afﬁliates, ﬁnancial business group, business partners and other entities whom we have relationship with (collectively, "Related Products and Services" for the purpose of this clause), to contact or otherwise inform you about information on the Related Products and Services which we believe may be of interest to you or the entity you work for via appropriate contact channels (such as mails, e-mails, text messages, telephone calls); • to provide you with privileges and special offers for the Related Products and Services, to create and display online advertisements of the Related Products and Services via various channels (including, on social media platforms, instant messaging applications e.g., Facebook. Google, Line and Instagram), to target our customers for our Related Products and Services offers or promotions tailored to our customers' interests; • to conduct market analysis and research, to analyse customers’ behaviours and segmentation, to analyse and target other anonymous individuals who may share similar characteristics (Lookalike), to operate loyalty programs, referral programs, and other similar schemes and campaigns, including marketing and sales schemes and campaigns, to announce award and/or lucky draw prize, to evaluate or improve the effectiveness of our marketing efforts and campaigns, to manage customer relationships and engagement, to carry out promotion planning, organising, conduct meetings and seminars, and visit Krungsri Group

(3) Services improvement

Purposes	Description
Service Reports	To prepare and circulate (both internally and externally) reports on the provided Products and Services (including, reports on performance, services performance, sales, customer contact results, settlements for merchants and card network companies, collateral appraisals), to prepare reports required by competent authorities, analytical reports (e.g., for inactive customers for initiating sales campaigns), and other reporting activities for our business purposes
Improvement of services	To improve our existing Products and Services, to develop and test our new Products and Services including those from our Business Partners, to develop new ways of offering our Products and Services to best suit your needs and to grow our business, to analyse data for system improvement (e.g., to develop a model of customer segmentation for enhanced efﬁciency in providing the Products and Services), to conduct customer satisfaction surveys or of other person from which Krungsri Group receive personal data (such as questionnaire respondents), to conduct surveys on our staff's performance, to analyse usage trends, to personalize and optimize your best experiences with our products and Services (e.g., our mobile applications, websites), to recognize you across different browsers and devices you use, to conduct the Products and Service performance monitoring and analysis
Conduct of data analytics	• to examine which parts of our online channels (such as our mobile applications, our websites) you visit and other online channels you interact with or which aspects of online channels you ﬁnd most useful, to conduct trafﬁc monitoring of our online Products and Services, to evaluate user interface and experiences, to test features or functionalities, to identify sources of your Data; • to analyse data for improved business opportunities, to analyse future credit approval, to review customers’ credit, to identify trends of asset appraisals, to review the appraisals (for collaterals); • to identify and solve problems to existing Products and Services, to carry out qualitative development of data
Krungsri Group's websites and platforms usage	To maintain, use, follow up, inspect, and manage websites and platforms (including mobile applications) to facilitate and allow appropriate, efﬁcient, and safe use of websites and platforms of Krungsri Group, to improve Krungsri Group’s website and platform layouts and contents to enable you to access systems of Krungsri Group and to provide technical support to you

(4) Technological system management, fraud prevention, legal compliance, and data protection

Purposes	Description
Detection and prevention of fraud including data protection	To ﬁnd, detect and prevent fraud risk, and resolve fraudulent activities, fraudulent transactions, deception, and fraudulent applications, to identify, follow up, investigate, verify, and control logs of network activities, to take other steps to prevent activities aimed to cause damage, fraud, or illegal activities including activities relating to data maintenance, to identify security events, to investigate security issues of data, to protect security for life, health, property, and other rights of persons, to assist with crime prevention
Technological system management	• to perform penetration testing, to perform debugging and error repair, to analyse the use of our online Products and Services, to carry out other data maintenance related activities, to protect security of information technology and to inspect information technology security and to carry out other forms of data maintenance, to provide information technology support and assistance (Helpdesk); • to comply with technological policies, to create and maintain code and proﬁle for you, to manage access to systems which Krungsri Group has the right to access, to delete inactive accounts, to use business control systems to allow Krungsri Group to operate business, to identify and solve problems that occur to the information technology of Krungsri Group, to maintain security of Krungsri Group’s systems
Compliance with law and dispute resolution	To comply with applicable laws (including, any subordinate laws, legal or regulatory guidance, codes of conduct, orders, opinions, interpretations, our and our afﬁliates' internal policies), to sue, defend against, participate in or otherwise respond to civil, criminal, or regulatory lawsuits, subpoenas, legal processes, legal execution processes, regulatory requirements, law enforcement requirements, to exercise our legal rights or defend against legal claims (including, for debt collections and recoveries on overdue accounts), to address complaints and disputes, to comply with regulatory requirements, for investigations and other forms of interaction with government authorities, or to comply with orders of government authorities which may include orders from authorities outside of Thailand and/or to cooperate with courts, regulatory authorities, government ofﬁcials, and law enforcement agencies when Krungsri Group has reasonable grounds to believe that it has lawful duties to do so, and when it is necessary to disclose your Data to comply with the law, to resolve disputes, to report on credits, to deposit your assets at the Department of Legal Execution instead of performance of obligations

(5) Managing Krungsri Group's businesses

Purposes	Description
Business management	To operate our businesses, including without limitations, to strategize and devise plan for our business and for our ﬁnancial; to add and test systems and processes, to manage internal administration; to follow up and make references (such as when we receive your request), to archive data (e.g. backup and archiving in separate databases), to comply with our IT policies, to ensure business continuity and the availability of systems, to perform our contractual obligations to which we are party(such as contracts with our business partners, service providers or other asset management companies), or under which we are acting as a broker or an agent; to perform risk control, to practice corporate governance, to manage ﬁnance, accounting and tax, to audit and administer the business, to comply with the regulation, including internal control requirements and internal audits, to comply with internal policies and procedures in accordance with the internal rules of corporate governance and good governance practices.
Corporate transactions	In the event of sales, transfers, mergers, reorganizations, or similar events, Krungsri Group must disclose and transfer your Data to one or more third parties as part of that transaction.
Supply of Products and Services and communication about business operations(This objective applies when Krungsri Group collects your Data as Connected Persons)	• to purchase Products and Services from Business Partners of Krungsri Group (such as to create and deliver purchase orders to you or to Business Partners), to contact you when you or Business Partners sell Products and Services to Krungsri Group, to take steps about payment, to plan, to perform and to manage contractual relationship with you or Business Partners, to supervise performance of contracts and compliance with policies of Krungsri Group or Business Partners and to comply with internal regulations of Krungsri Group’s afﬁliates (including to investigate and correct non-compliance with such regulations or policies); • to perform capital management and business transaction (such as transaction in relation to subscription and investment with you or Business Partners); • to communicate with you or Business Partners about business operations (such as to communicate with Business Partners about projects of Krungsri Group or projects of Business Partners) or about other business opportunities (such as to respond to queries or requests, to inform you and to distribute published materials which you may be interested) and to facilitate to you or Business Partners while participating in project(s) with Krungsri Group including organizing events and any related meeting; • to input your or Business Partners’ data, to collect, record, and manage your data or of Business Partners including other related records for Services providing by Krungsri Group, to update your or Business Partners’ data to be present and accurate, to copy or reproduce documents on source of incomes, to record business transactions and operations, management and maintenance of data regarding business operations of Krungsri Group; • to perform on closing or existing of contracts or any other performances so as to terminate business relationship with you or Business Partners.

(6) Relationships with shareholders of companies in Krungsri Group

Purposes	Description
Management relating to shareholders of companies in Krungsri Group	To verify identity and signature such as when you contact, carry out transactions, exercise your statutory rights as a shareholder of Krungsri Group companies or when you exercise rights on behalf of shareholders To manage shareholders’ meeting, to attend shareholders’ meetings, to exercise votes, to abstain from voting, to issue/transfer share certiﬁcates, to sell shares, shareholders’ register, or other relevant documents.

Purposes

Description

Management relating to shareholders of companies in Krungsri Group

To verify identity and signature such as when you contact, carry out transactions, exercise your statutory rights as a shareholder of Krungsri Group companies or when you exercise rights on behalf of shareholders To manage shareholders’ meeting, to attend shareholders’ meetings, to exercise votes, to abstain from voting, to issue/transfer share certiﬁcates, to sell shares, shareholders’ register, or other relevant documents.

2.3. Sensitive Personal Data

Krungsri Group will only collect, use, or disclose sensitive personal data based on your explicit consent, for establishment, defence, compliance with or exercise of legal claims, for satisfying legal obligations in relation to substantial public interests or otherwise as permitted by law. Where consent is required, we will separately ask for your consent using the appropriate means. Categories of sensitive personal data that we may collect from you depend on factors including which Krungsri Group companies that you may contact.

Categories of sensitive personal data	Purposes
Criminal Records	To collect and use your criminal records for detecting, preventing, and prosecuting unlawful acts and fraudulent conduct and for compliance with the requirements of applicable laws and regulations.
Biometric data	We need to collect and use your biometric data (e.g., your facial and ﬁngerprint data) for customer identity veriﬁcation, for underwriting processes for credit card issuance and/or personal loan approval, and/or for underwriting and loan approval processes for hire purchase, leasing and loan for authentication, for applying, accessing and/or taking any other steps to use the Products and Services of Krungsri Group (e.g., by accessing or opening an account via our mobile application or at our branch) In addition, we may also collect your voice to verify your identity to resolve issues of which you inform us and may disclose your voice data to speech recognition service providers for tuning and analysing your voice data.
Religion data	In general, we do not require religion data from you in offering our Products and Services. In practice, however, we may inevitably receive religion data from you (e.g., by a scanned copy of your national identiﬁcation card accompanying agreements, Products and Service applications or for verifying identity of business partners, individuals, directors, shareholders, and authorized directors of a company). In such a case, we will protect your religion data under the applicable laws.
Disability data	If you have a disability, Krungsri Group may collect, use, or disclose your disability data including your ﬁngerprints for the purposes of entering into contracts between you and Krungsri Group (e.g., if you are disabled and cannot sign your name in a contract with Krungsri Group, then Krungsri Group will request for your ﬁngerprints instead), for the purposes of compliance with a law to achieve the purposes with respect to substantial public interest in order to protect the fundamental rights and interest of the data subject (e.g. in the event that the customer redeems investment units of tax beneﬁt funds before maturity or in violation of the regulatory conditions with respect to tax exemption, it is necessary for the customer to present proof of disability in order to enjoy withholding tax exemption).
Personal data about vulnerable customers may be sensitive personal data	If Krungsri Group, taking into account your personal circumstances, considers that you are a customer with characteristics of vulnerability according to the relevant notiﬁcations of the Bank of Thailand or the Ofﬁce of Securities and Exchange Commission, including hearing or visual impairment, having health conditions or other characteristics of vulnerability, Krungsri Group will provide you with a level of care that is appropriate for a vulnerable customer when communicating with you or providing you with our services. To ensure the fair treatment of vulnerable customers and to comply with the requirements under the notiﬁcations, Krungsri Group is required to collect data on vulnerability, including, health data and disability data, that may be sensitive personal data under the applicable data protection laws, and to analyse the Data of vulnerable customers to identify their customer groups so as to offer products and services that are suitable for their circumstances.

3. Who we disclose your Data to

Krungsri Group may disclose your Data to the following parties for the purposes described in section 2 above, depending on the context of your relationship with us, Krungsri Group companies that you have interacted with, and the nature of Products and Services you obtain from us:

Categories of recipients of personal data	Descriptions
Afﬁliates	Krungsri Group may disclose your Data to other companies within Krungsri Group, our afﬁliates, as well as other entities in Krungsri Group companies including MUFG Bank, Ltd. and MUFG group companies in Thailand and in other countries, including without limitations, Japan, Singapore, the United States of America, and the United Kingdom. We may also disclose your Data to centralized storage systems or process it at a central point within Krungsri Group, our afﬁliates, and such other companies within Krungsri Group for the purpose of efﬁciency.
Service providers	Krungsri Group may engage other companies to provide services for us and to support us in our business operation (e.g., outsourcers, representatives of sub-contractors). We may disclose your Data to these service providers, or they may collect your Data on our behalf, for various business purposes, including customer services. For example, we engage and outsource some of our business functions to infrastructure, IT and/or software service provider including, data and/or document storage, cloud service, software, platform, network, website developer, postal mail service providers, delivery or logistic service providers, destruction service providers, document delivery service providers, administrative and business support service providers, payment service providers, card embossing service providers, printing service providers for billing and/or letters, warehouse, debt collectors, point redemption management service providers, loyalty management service providers, research agencies, analytics service providers, infrastructure providers, marketing agencies; email sending service providers; SMS sending service providers, data entry service providers, credit scoring service providers; telesales service agents, data collection service providers, attachment service providers, document printing service providers, ownership transfer service providers, telecommunication service providers, crowd funding service providers, internet service providers, mobile phone service providers, digital ID service providers, advertisement service providers, social network service providers, administrative service providers, credit reference service providers, risk management service providers, news reporters, public relations service providers and/or dispatcher, payment network service providers, business administrative and support service providers, document collection and destruction service providers, data backup service providers, representatives of telesales service providers, asset registration service providers, appraisal service providers, property inspection service providers, and public auction service providers, identiﬁcation veriﬁcation service providers. In addition, we may also disclose and/or transfer your Data to service providers of insurance companies (e.g., loss surveyors, loss adjustors, hospitals, garages, and counterparty's insurance companies). Krungsri Group will disclose your Data to other service partners of Krungsri Group where Krungsri Group collects your Data from you as a Connected Person of Business Partners.
Professional advisors	Krungsri Group may disclose your Data to professional advisors relating to audit, legal, accounting, and tax services who assist in our business operations and defending or bringing any legal claims, initiating, and managing auction or taking other legal actions such as depositing properties instead of performing obligations. Krungsri Group will disclose your Data to Business Partners who are other professional advisors of Krungsri Group where Krungsri Group collects your Data from you as a Connected Person of Business Partners who are professional advisors of Krungsri Group.
Business Partners	Krungsri Group may disclose your Data to companies that we have collaborated with to offer or enhance services to our existing or prospective customers (e.g., airlines, hotels, ﬁtness centres, telecommunications service providers, debt management and restructuring company). For example, your Data may be disclosed to merchants from which you purchase Products and Services for such purposes as processing your purchase orders, preparing, and delivering Products and Services you order, to co-project/event organizers, to co-investors, to co-branded partners, our insurer, and reinsurer partners (e.g., automotive insurance, health insurance, property insurance, travel insurance, personal accident insurance, life insurance), agents, vendors, merchants who send ﬁnancing applications of customers to Krungsri Group, telecommunications service providers, payment platform and counter service providers, survey service providers, marketing service providers, advertisement materials and sales promotion service providers, banks and other ﬁnancial institutions, asset management companies, securities companies, mutual fund brokerage securities companies, investment advisory companies, marketing companies, representatives of ﬁnancial institutions, telephone number service providers, providers of platform for ﬁnancial Products and Services, real property merchants who send your credit applications to Krungsri Group, property developer selling agent. Krungsri Group will disclose your Data to Business Partners where Krungsri Group collects your Data from you as a Connected Person of Business Partners of Krungsri Group.
Financial institutions , credit bureau, or insurance companies	Krungsri Group may also disclose your Data to ﬁnancial specialists who provide ﬁnancial service support to Krungsri Group (e.g., other banks, ﬁnancial institutions, credit bureaus, debt collectors debt management organisations, payment service providers, service providers for exchanging secure ﬁnancial transaction messages, worldwide payments, and credit transactions, processing electronic transactions worldwide including domestic and international securities transactions, payment transactions and credit reference services), agencies performing the duty of quality assurance, agencies providing anti-fraud services, agencies providing debt collection and attachment services, providers of property tracing services, including custodians, trustees of mutual funds, sub-managers, securities companies providing brokerage securities services, securities asset management companies, registrar services, beneﬁciaries, counterparties, banks, ﬁnancial institutions, and credit card companies. In addition, we as an insurance broker may disclose your Data to our partners who are insurance companies (such as automotive insurance companies, property, or life insurance companies).
Third parties as an authorised or permitted person by you	Krungsri Group may disclose your Data based on your consent or your instruction such as to Business Partners of Krungsri Group.
Third parties as assignees, transferees, or novatees	Krungsri Group may assign, transfer, or novate our rights or obligations to a third party in accordance with an agreement between you and Krungsri Group. We may disclose or transfer your Data to assignees, transferees, or novatees, including prospective assignees, transferees, or novatees.
Third parties who act on your behalf or provide services to you	Krungsri Group may disclose or transfer your Data to representatives/ your employer, sponsor, and third parties that have roles in delivering services to you or someone acting on your behalf that may provide us with information about you (e.g., hospitals, garages, etc.).
Third parties connected with corporate transactions	Krungsri Group may disclose or transfer your Data to our Business Partners, investors, signiﬁcant shareholders, assignees, prospective assignees, transferees, or prospective transferees in the event of any reorganization, merger, acquisition, sale, purchase, joint venture, assignment, dissolution, or any similar event involving the transfer or other disposal of all or any portion of our business, assets, or stock.
Government authorities and others organisations	Krungsri Group may disclose your Data for legal or necessary purposes to government entities or regulatory bodies (e.g., the Bank of Thailand, The Ofﬁce of Securities and Exchange Commission, the Revenue Department, the Anti-Money Laundering Ofﬁce, Thailand Securities Depository Company Limited, the Department of Provincial Administration, police ofﬁcers, courts, the Legal Execution Department, the Department of Land Transport, the Ofﬁce of the Consumer Protection Board, agencies performing the duty of registering collaterals, collaterals that are scripless securities, registering share pledges, and registering vehicles (when you purchase compulsory insurance), the Ofﬁce of Insurance Commission (for the purpose of collecting, using and/or disclosing of your Data to the Ofﬁce of Insurance Commission, and for the purpose of regulating and promoting insurance business according to Insurance Commission Act, Non-Life Insurance Act, Life Insurance Act, and in accordance with privacy policy of the Ofﬁce of Insurance Commission by visiting at https://www.oic.or.th). We may also need to disclose personal data to other agencies for legal, regulatory, and other purposes which are signiﬁcant and in the case that we receive a request from regulatory agencies or government agencies for the purposes of complying with the laws, lawful orders, audits, or legal procedures/claims.
Service providers of insurance company	Krungsri Group may disclose and/or transfer your Data to service providers of insurance companies such as loss surveyors, loss adjustors, hospitals, garages counterparty's insurance companies.
E-commerce platforms	Krungsri Group may disclose and/or transfer your Data to e-commerce platforms if you apply for their services.
Other categories of data recipients	Krungsri Group may disclose your Data to other categories of recipients, including members of the National Digital ID (NDID) platform, your insurer, your contact persons and/or family members, your employers, non-proﬁtable organizations or foundations, hospitals, or other organizations in connection with our Products and Services and/or your rewards donations and redemptions. Examples of these other types of recipients include: • When you apply for a loan, we may disclose your Data to third parties to approve security for the loans or to enforce such security upon your default (such as Thai Credit Guarantee Corporation) • We may disclose to the Valuers Association of Thailand and/or Thai Valuers Association your Data including other necessary data relating to the collaterals provided by you in order to appraise your collaterals. • We may disclose your Data to other agencies which are members of digital identity authentication service providers to verify and authenti- cate your identity when you apply for Products and Services (such as members of Digital ID (NDID)). • We may disclose your Data to credit card issuers who have issued you a credit card that you use in purchasing goods or services from merchants who are our Business Partners to process data and com- plete payment transactions. • We may disclose your Data to a car sale agent to notify results of auto loans and relevant details when you are a customer of auto loan products. • We may disclose your Data to persons responsible for managing and taking steps relating to public auctions of vehicles repossessed by us to distribute information about public auctions when you are a customer of our auto loan products and are in default of repayment to us. • We may disclose your Data to persons involved in providing Products and Services to you (e.g., a contact person designated by you for Krungsri Group to contact for purposes of debt collection, guarantors, your family members, persons having the possession of property under a leasing/hire purchase agreement). • We may disclose your Data to representatives, employers, persons providing support to you, and other third parties having the duty to provide services to you. We may disclose your Data to persons involved in services that you have received from Krungsri Group such as sellers of vehicles who forward a loan application to Krungsri Group, broker, agents, debt purchasers, persons involved in services that you have received (e.g., a contact person designated by you for Krungsri Group to contact for purposes of debt collection, guarantors, your family members, persons having the possession of property under a hire purchase agreement), or bank arrangements used by us in managing your payment and card payment service providers, persons handling claims and values of Krungsri Group, property tracing and attachment agents, those who are joint customers in your accounts, representatives who have forwarded your applications to us, insurance companies, investment planners who have forwarded your applications to us, assignees and/or persons accepting transfer of duties, members of digital identi- ty authentication service providers to verify and authenticate your identity (including Identity Provider (IdP), Relying Parties (RP), and Authoritative Sources (AS)), representatives, your employers, sponsors, your third parties who have roles and duties in providing services to you, FundConnext Platform, payment system service providers (such as FinNet), security depositors/custodians (such as Thailand Securities Depository Company Limited), Association of Investment Management Companies, persons accepting collaterals/pledgee).

4. Transfer of your Data to other countries

We may need to transfer your Data to our afﬁliates, third parties located overseas (e.g., Japan, Singapore, Taiwan, Philippine, Indonesia, Laos, Cambodia, Myanmar, Vietnam, Israel, India, Australia, the United States of America, the United Kingdom and the European Union Countries ) including Cloud platforms for achieving our business purposes or for your beneﬁt, depending on which Krungsri Group companies that you have interactions with, such as when we use systems and services and transfer your Data to our service providers operating outside Thailand for credit scoring as part of our underwriting process or when we provide you with remittance service. We may need to forward and transfer your Data to representative banks to complete your transactions or to our Business Partners in abroad for introducing of any potential investment project and for any performances in relation to such projects, or when you apply for products or services from our afﬁliates or business partners. In addition, we may need to transfer your Data overseas via our payment networking provider for approving and settling the transactions you request. We may also transfer your Data to an overseas Master Fund to comply with the regulations of the Master Fund, including applicable laws and regulations. We may also disclose your Data to an overseas Sub-Manager for the purposes of managing investments. In addition, we may store your Data in our server (such as in Singapore) to provide information technology support outside of Thailand. We may also disclose or transfer your Data to our parent company, afﬁliates, and relevant regulators and government authorities of other countries for which the Personal Data Protection Committee under the Act has not ruled that this country has adequate data protection standards at the time when this Notice is prepared. When we need to transfer your Data to a country with data protection standards that are not equivalent to that of Thailand, we will ensure that there shall be sufﬁcient data protection measures for the transferred Data, or the transfer is otherwise permitted in accordance with the applicable data protection law. For example, prior to transferring your Data to the applicable third parties, we may require such third parties to represent and warrant that the transferred data will be protected by data protection standards which are equivalent to those required in Thailand.

5. How long we will store your personal data

We will store your Data only for as long as it is necessary for the purposes for which it was collected, as explained in this Notice and in accordance with the applicable law. However, we may retain your Data for a longer period to comply with applicable laws and regulations and our internal policy or with regard to our operational requirements, such as proper account information maintenance, facilitating client relationship management, and responding to legal claims or regulatory requests.

6. Your rights

Subject to the provisions of data protection law, you have a number of rights regarding the collection, use, disclosure and/or transfer of your personal data, including the rights
(1) to access: you can access and obtain a copy of information relating to the collection, use, disclosure and/or transfer of your personal data, and a copy of your personal data, or request that we disclose the acquisition of your personal data without your consent;
(2) to rectify: where you consider that your personal data is inaccurate, not up-to-date, or incomplete, you can require that such Personal Data be modiﬁed accordingly;
(3) to erase or destroy: you can request the deletion, destruction, or anonymization of your personal data to the extent permitted by law;
(4) to restrict: you can request the restriction of the use of your personal data, for example in the case you found that your personal data is inaccurate, you can request to restrict the use of such data until it is modiﬁed;
(5) to object: You have the right to object to the collection, use, or disclosure of your personal data including for direct marketing purposes in any case, which covers proﬁling related to such direct marketing;
(6) to withdraw your consent: where you have given your consent for the collection, use, or disclosure of personal data, you have the right to withdraw your consent at any time;
(7) to data portability: where legally applicable, you have the right to request us to provide your personal data in a structure, commonly used and machine-readable format using tools or devices which function automatically and by which personal data can be used and disclosed in automatic mode; and transmit or transfer your personal data in such format to another organization; and
(8) to lodge complaints in case you notice that Krungsri Group does not comply with the data protection laws: you are entitled to lodge a complaint with the competent authority regarding the collection, use, and/or disclosure of your personal data by us or on our behalf. Before approaching the competent authority, we would, however, appreciate the chance to deal with your concerns, so please contact us in the ﬁrst instance.

You may contact Krungsri to exercise your right, by using any of the following channels.

Type of Data subjects	Customer			Vendor / Business Partner	Visitor / CCTV
Channel	Call Center 1572	Krungsri Branch	Electronic Channel	DPO.Procurement@krungsri.com	DPO.CentralAdmin@krungsri.com / Security.center@krungsri.com
Right to withdraw consent
Other rights			-

For individuals residing in Laos, to exercise your rights at the Vientiane Main Branch, please contact the branch directly.

Type of Data subjects	Customer	Vendor / Business Partner	Visitor) / CCTV
Channel	Vientiane Branch	Vientiane Branch	Vientiane Branch
Right to withdraw consent
Other rights

Your request to exercise any of the above rights as a data subject may be limited by the law. There may be certain cases where we can reasonably and lawfully decline your request, for example, due to legal obligations or court orders.

7. Security measures for protecting Data

Krungsri Group implements the policies and security measures for protecting Data, including management measures, technical protection and physical protection measures regarding the access or control of the use of Data in accordance with this Notice as well as policies provided for personnel of both internal and external corporates who have recognised the importance of Data security strictly. In addition, if Krungsri Group acknowledges that countries of the counterparties which we may transfer Data to has insufﬁcient data-protection standards, we will procure them to have adequate data-protection standards.

8. Links to other third party websites

For website users, our Products and Services may contain links to social networks, platforms, and other websites that are operated by third parties. While we try to link only to websites that share our high standards for privacy, we do not take responsibility for the content or the data protection standards employed by such other websites. Unless this Notice otherwise provides, any personal data you provide to any such third-party website will be collected by that party and not by us and will be subject to that party’s privacy notice/policy (if any), rather than this Notice. In such a situation, we will have no control over, and shall not be responsible for, that party’s use of your personal data.

9. Contact us

If you have any questions, comments, or concerns about our privacy practices, please contact us at the appropriate address below. We will respond to your requests as soon as possible and provide you with additional privacy-related information.
E-mail : dpo.compliance@krungsri.com
Address :
- Bank of Ayudhya Public Company Limited (Head ofﬁce) 1222 Rama III Road, Bang Phongphang, Yan Nawa, Bangkok 10120 Thailand
Telephone : 0-2296-2000
- Bank of Ayudhya Public Company Limited (Laos Branch) Baan Hassadi, 084/1-2 , Lane Xang Avenue, P.O. Box 5072 Chanthaboury District, Vientiane, Lao. P.D.R.
Telephone : 021 218777
Additional information on how to reach our Data Protection Ofﬁcers is provided in the attachment to this Notice.

Attachment

Name List of Krungsri Group's Companies

Company’s Name	Contact Details
(1) Bank of Ayudhya Public Company Limited (BAY)	Email: dpo.compliance@krungsri.com Address: - Bank of Ayudhya Public Company Limited (Head Ofﬁce), 1222 Rama III Rd., Bang Phongphang, Yan Nawa, Bangkok 10120 Telephone: 0 2296 2000 - Bank of Ayudhya Public Company Limited (Laos Branch), Baan Hassadi, 084/1-2 , Lane Xang Avenue, P.O. Box 5072 Chanthaboury District, Vientiane, Lao. P.D.R. Telephone: 021 218777 (For individuals in Laos, you can contact us through the Vientiane branch)
(2) Krungsri Consumer Group Companies (KSC) comprising: • Ayudhya Capital Services Co., Ltd. (AYCAP) • Krungsriayudhya Card Co., Ltd. (KCC) • General Card Services Limited (GCS) • Krungsri General Insurance Broker Limited (KGIB) • Krungsri Genesis Company Limited (KGS)*	Email: dpo.ksconsumer@krungsri.com Address: Krungsri Ploenchit Tower, 550 Ploenchit Rd., Lumpini, Pathumwan, Bangkok 10330 Telephone: 02627 8000
(3) Ayudhya Capital Auto Lease Public Company Limited (AYCAL)	Email: dpo.ksauto@krungsri.com Address: Krungsri Ploenchit Tower, 16th Floor, 550 Ploenchit Rd., Lumpini, Pathumwan, Bangkok 10330 Telephone: 0 2627 6010, 02740 7400
(4) Ayudhya Development Leasing Co., Ltd. (ADLC)	Email: dpo-adlc@krungsrileasing.com Address: Krungsri Ploenchit Tower, 14th Floor, 550 Ploenchit Rd., Lumpini, Pathumwan, Bangkok 10330 Telephone: 0 2208 2300
(5) Krungsri Asset Management Company Limited. (KSAM)	Email: dpo.ksam@krungsri.com Address: Ploenchit Tower, 1st - 2nd Floor (Zone A) and 12th and 18th Floor (Zone B), 898 Ploenchit Rd., Lumpini, Pathumwan, Bangkok 10330 Telephone: 0 2657 5757
(6) Krungsri Securities Public Company Limited (KSS)	Email: dpo.kss@krungsrisecurities.com Address: 25 Bangkok Insurance Building, 17th Floor, South Sathorn Road, Sathorn, Bangkok 10120 Telephone: 0-2659-7000, 0-638-5500
(7) Krungsri Finnovate Company Limited (KFIN)	Email: dpo.kfin@krungsri.com Address: Krungsri Ploenchit Tower, 17th and 20th Floor, 550 Ploenchit Rd., Lumpini, Pathumwan, Bangkok 10330
(8) Krungsri Nimble Company Limited (KSN)	Email: dpc@krungsricapital.com Address: Bank of Ayudhya Public Company Limited (Head Ofﬁce), 21st Floor, 1222 Rama III Rd., Bang Phongphang, Yan Nawa, Bangkok 10120 Telephone: 0 2208 2849

Version 1.8

Terms of Use

Quick Menu

Privacy Notice

Effective on August 2024