Privacy Notice

Privacy Notice

Last Updated: 13 February 2023

Dear Vendors,
Worldlease Company Limited (“Company”) values a privacy and strives for protecting your personal data or personal data relating to individuals connected to your business (“Personal Data”) based on the laws of Thailand.

This Privacy Notice explains: -

What kind of Personal Data does the Company collect? This includes what you tell the Company about yourself or the individuals connected to your business (“you”, “your” or “yourself”) which shall include employees, staff members, directors, representatives, shareholders or your Ultimate Beneficial Owner if you are a juristic person, and what the Company learns by having you as the vendor, and the choice you give the Company about what marketing materials you want the Company to send to you.
How does the Company use your Personal Data?
Who does the Company disclose the Personal Data to?
What are the choices the Company offer, including how to access and update your Personal Data?
What are your privacy rights and how does the law protect you?

1.Collection of Personal Data

The Company collects many different kinds of Personal Data, depending on various circumstances that are relevant to procuring products and/or services, and making payments.

The Company collects the Personal Data about you from a variety of sources, including but not limited to:-

From you directly during the process of becoming the vendor for the Company
From third parties during the process of becoming the vendor e.g., credit checks, trade references, our customers, law enforcement authorities, etc.
When you talk to the Company on the phone or in branch, including recorded calls, e-mails, notes and other means
Information received from insurance claims or other documents
Any financial reviews and explanations
When you manifestly publish your Personal Data, including via social media, in this case, the Company will collect your Personal Data from your social media profile(s), to the extent that you choose to make your profile publicly visible
When the Company receives your Personal Data from third parties, e.g., your employer, the Company’s customers, credit reference agencies, law enforcement authorities or any governmental agencies, etc.

The Company sometimes collects the Personal Data from additional online and offline sources including commercially available third-party sources, such as credit reporting agencies (the National Credit Bureau). The Company may combine this information with the Personal Data the Company has collected about you under this Privacy Notice.

In some instances, the Company may engage unaffiliated third parties to collect the Personal Data about your online activities when you visit the Company’s online sources. The Company may also use the Personal Data collected across non-affiliated websites for the purpose of serving you advertisements related to your browsing behaviour. While the Company engages in this practice, the Company will provide an appropriate notice and choice so that you can opt-out such collection.

The categories of Personal Data about you that the Company collects, subject to the applicable law, include but not limited to: -

Personal details: Name(s), last name, gender, date of birth, marital status, personal identification number, passport number, other government issued identification number(s) or Personal Data provided in any documents issued by government or authorities, tax identification number, nationality, image of passport, driving license, signatures, authentication data, information provided by you as answer to the Company’s authentication question
(e.g., passwords, password recovery answer, PINs, facial and voice recognition data, etc.), photographs and CCTV images
Family details: Names and contact details of family members and dependents
Contact details: Address, telephone number, email address and social media profile details
Education history: Details of your education and qualifications
Financial details: Billing address, details of your bank account, credit card numbers, cardholder’s or account holder’s name and details, instruction records, transaction details and counterparty details
Transactional data: Full beneficiary names, address and other details including communications on Company transfers of the underlying transaction
Electronic data: IP address, cookies, activity logs, online identifiers, unique device identifiers and geolocation data
CCTV data and geolocation data: Data showing locations of cash withdrawals or payments for security reasons, or to identify the location of the nearest branch or service suppliers for you
Sensitive Personal data: The Personal Data that the law specifically prescribes includes race, ethnic origin, political opinion, belief, religious or philosophy, sexual behavior, criminal record, health record, disability, labour union, heredity or other information which affects you in the same sense and as prescribed by the Thailand Personal Data Protection Committee.

2.Use of Personal Data

The Company may collect and use your Personal Data only if the Company has proper reasons to do so. This includes sharing it outside the Company.
The Company will rely on one or more of the following lawful grounds when collecting, using and/or disclosing your Personal Data: -

When it is to fulfil the contract the Company has with you (contractual basis) - that is when the Company needs your Personal Data to deliver a contractual service to you or before entering into a contract with you;
When it is the Company’s legal obligation (legal obligation) - that is when the Company needs to collect, use and/or disclose your Personal Data to comply with the law or statutory obligation;
When it is in the Company’s legitimate interest (legitimate interest) - that is when the Company collects, uses and/or discloses your Personal Data for the Company’s legitimate interest as permitted under the law, so long as your fundamental rights are not overridden by the Company’s legitimate interest; and/or
When you consent to it (consent) - that is when you allow the Company to collect, use and/or disclose your Personal Data for certain purposes.

The purposes and legal basis for which the Company may collect, use and/or disclose your Personal Data are: -

Purposes of data collection, use and/or disclosure	Lawful basis for collection, use and/or disclosure
Procurement of products and/or services
To make a decision about procuring products and/or services with you To make and manage payments To manage charges and interests due To collect and recover the products and/or services that are owed to us To deal with legal disputes	Contractual basis Legitimate interest Legal obligation
Business relationship
To manage our relationship with you or your business To communicate with you about the products and/or services	Consents Contractual basis Legitimate interest
Business improvement
To identify issues with existing products and/or services To plan the improvements to the existing products and/or services	Contractual basis Legitimate interest Legal obligation
Security and risk management
To prevent crimes and manage security for example, use of CCTV (with your photos, videos or voice collected/recorded) To detect, investigate, report, and seek for a financial crime prevention To manage risk To do internal audits To seek and/or provide legal advisory within the Company To obey the relevant laws and regulations	Legal obligation Legitimate interest Contractual basis

When the Company relies on the legitimate interest as the reason for collecting, using and/or disclosing the Personal Data, it has considered whether or not your fundamental rights are overridden by the Company’s legitimate interests and has concluded that they are not.

If you fail to provide your Personal Data to the Company

Where the Company is required by law to collect your Personal Data or need to collect your Personal Data under the terms of a contract the Company has with you and you fail to provide your Personal Data when requested, the Company may not be able to perform obligation under the contract the Company has with you or plans to enter into with you (for example, to enter into a contract of procurement of products and/or services with you). In this case, the Company may not be able to perform its obligations or enter into the contract with you, but the Company will notify you if this is the case at the time your Personal Data is collected.

3. Disclosure of Personal Data

The Company may share your Personal Data with others where it is lawful to do so, including where the Company or the other person: -

needs to provide you with the requirement under a contract regarding the products or services (e.g. to fulfil a payment request, etc.)
has legal duties to do so (e.g., to assist with detecting and preventing fraud, tax evasion, financial crime and money laundering etc.)
needs to, in connection with a regulatory reporting, litigation, asserting or defending legal rights;
has legitimate interest to do so (e.g., to manage risk, verify identity, enable another company to provide you with the services you have requested or assess your suitability for the products and/or services, etc.) and/or
asks for your consent to share it, and you agree.

The Company may share your Personal Data for the above purposes with others, including: -

other CIMB group companies and any sub-contractors, agents or service providers who work for the Company or provide the services to the Company or other CIMB group companies, including their employees, sub-contractors, service providers, directors and officers
any trustees, beneficiaries, administrators or executors
people who give guarantee or other securities for any amount you owe the Company
people you make the payments to and/or receive payments from
your intermediaries, correspondent and agent Company, clearing houses, clearing or settlement system, market counterparties and any company you carry out investment services through the Company
other financial institutions, lenders and holders of securities, tax authorities, trade associations, credit reference agencies, payment service providers and debt recovery agents
any fund managers who provide asset management services to you and any brokers who introduce you to the Company
any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition or takeover, including any transfer or potential transfer of any of the Company’s rights or duties under the Company’s agreement with you
law enforcement, government, courts, dispute resolution bodies, the Company’s regulators, auditors and any party appointed or requested by the Company’s regulators to carry out investigations or audits of the Company’s activities
other parties involved in any disputes, including disputed transactions
fraud prevention agencies who will use it to detect and prevent fraud and other financial crime, and to verify your identity
anyone who provides instructions or operates any of your accounts, products or services on your behalf (e.g., Power of Attorney, solicitors etc.) and/or

anybody else that the Company has been instructed to share your Personal Data with by you.

There may be instances which the Company may share non-personally identifiable information about you to third parties, such as identifiers or one-way coding (cryptographic hash) of a common account identifier, such as a contact number or e-mail address, to enable the conduct targeted advertising.

Except as described in this Privacy Notice, the Company will not use the Personal Data for any purposes other than the purposes as described to you in this Privacy Notice. Should the Company intend to collect, use and/or disclose additional information which are not described in this Privacy Notice, the Company will notify you and obtain your consent prior to the collection, use and disclosure unless the Company is permitted to do so without your consent under the law. You will also be given the opportunity to consent or to decline approval of such collection, use and/or disclose of your Personal Data.

The Company will continue to adhere to this Privacy Notice with respect to the information the Company has in our possession relating to prospective, existing and former vendors.

Cross-border Transfer of Personal Data

Your Personal Data may be transferred to and collected and/or used in other countries, including Malaysia.

However, such countries may not have the same level of protection for the Personal Data as Thailand. In the event that the Company does this, the Company shall ensure that such countries have an appropriate level of Personal Data protection measures or that the transfer is lawful. For example, your Personal Data may be shared to other CIMB group companies in accordance with the Company’s Binding Corporate Rules (BCRs) or other relevant contractual arrangements, which require all CIMB group companies to follow the same rules or terms when collecting, using and/or disclosing your Personal Data. If you wish to request for a copy of the BCRs, you can do so by contacting the Company at dpo@worldlease.co.th.

The Company may need to send or transfer the Personal Data to carry out contract with you and the Company, fulfil the legal obligations, protect the public interests and/or for the Company’s legitimate interests. In some countries, the law might compel the Company to share certain Personal Data (e.g., with tax authorities). Even in these cases, the Company will only share Personal Data with people who have the right to see or access it.

4. Retention of Personal Data

The Company will retain your Personal Data for as long as it is necessary to carry out the purposes for which it was collected, that is, for the purpose of satisfying any regulatory reporting requirements, carrying out the Company’s service per your request or compliance with the applicable laws.

The Company will keep your Personal Data for up to 10 years after you stop being the Company’s vendor in order to ensure that any contractual disputes that may arise can be processed within that time. However, in the event of regulatory or technical reasons, the Company may keep your Personal Data for longer than 10 years. If the Company does not need to retain the Personal Data for longer than it is legally necessary, the Company will destroy, delete or anonymize it (so that it can no longer be associated with you).

5. Accuracy of your Personal Data

The Company needs your help to ensure that your Personal Data is current, complete and accurate. Please inform the Company of any changes to your Personal Data by: -

contacting the Company’s head office or Worldlease Care Center Tel. 0 2096 4599
updating your information at/via the Company’s head office or Worldlease Care Center Tel. 0 2096 459

The Company will occasionally request the updates from you to ensure the Personal Data the Company uses to fulfil the purposes of collection, use and/or disclosure are current, accurate and complete.

6. Your rights as data subject

Under certain circumstances, you have rights under data protection law in relation to your Personal Data. It is the Company’s policy to respect your rights and the Company will act promptly and in accordance with any applicable laws, rules or regulations relating to the collection, use and/or disclosure of your information.
Details of your rights are set out below: -

Right to withdraw: When the Company collects, uses and/or discloses your Personal Data under your consent, this right enables you to withdraw your consent to the Company’s collection, use and/or disclosure of your Personal Data, which you can do at any time. The Company may continue collecting, using and/or disclosing your Personal Data if the Company has another legitimate reason to do so.
Right to access: This enables you to receive a copy of Personal Data from the Company.
Right to correct: This enables you to have any inaccurate, outdated and/or incomplete Personal Data corrected. Please see above in 5 (Accuracy of your Personal Data) for detail of how you can request to have your Personal Data corrected.
Right to erasure: This enables you to ask the Company to delete, destroy or anonymize your Personal Data where there is no good reason for the Company to continue collecting, using and/or disclosing it. You also have the right to ask the Company to delete your Personal Data where you have exercised your right to object to collection, use and/or disclosure (see below). This is not a blanket right to require all Personal Data to be deleted. The Company will consider each request carefully in accordance with the requirements of any laws relating to the collection, use and/or disclosure of your Personal Data.
Right to object: This enables you to object to the collection, use and/or disclosure of your Personal Data where the Company is relying on the legitimate interest. You also have the right to object where the Company is collecting, using and/or disclosing your Personal Data for direct marketing purposes and profiling activities.
Right to restrict collection, use and/or disclosure: This enables you to ask the Company to suspend the collection, use and/or disclosure of your Personal Data, for example, if you want the Company to correct your Personal Data or to establish its accuracy or the reason for collecting, using and/or disclosing your Personal Data.
Right to portability: In certain circumstances, you can request to receive a copy of your Personal Data in a commonly used electronic format. This right only applies to your Personal Data that you have provided to the Company. The right to data portability only applies if the collection, use and/or disclosure is based on your consent or if the Personal Data must be collected, used and/or disclosed for the performance of obligation under a contract.
Right to Lodge a Complaint: This enables you to file the complaint with a related government authority, including but not limited to, the Thailand Personal Data Protection Committee in the case where, in your view, the Company, the Company’s employee or contractor violates or fails to comply with the Personal Data Protection Act of Thailand B.E. 2562 (2019) or notifications issued thereunder.

You may exercise any of your rights at any time using the contact details set out in 10. (Contact us) below. The Company may charge an additional reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, the Company may refuse to comply with your request in these circumstances.

The Company may need to request specific information from you to help the Company confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that your Personal Data is not disclosed to any person who has no right to receive it. The Company may also contact you to ask you for further information in relation to your request to speed up the Company’s response.

The Company tries to respond to all legitimate requests within 30 days. Occasionally, it may take the Company longer than 30 days if your request is particularly complex or you have made a number of requests. In this case, the Company will notify you and keep you updated.

Handling of complaints

In the event that you wish to make the complaint about how the Company collects, uses and/or discloses your Personal Data, please contact the Company’s head office or Worldlease Care Center Tel. 0 2096 4599 and the Company will try to consider your request as soon as possible. This does not prejudice your right to file the complaint with a government authority that has a data protection authority.

7. Security of your Personal Data

Information is the Company’s asset and therefore the Company places a great importance on ensuring the security of your Personal Data. The Company regularly reviews and implements up-to-date physical, technical and organizational security measures when collecting, using and/or disclosing your Personal Data. The Company has internal policies and controls in place to ensure that your Personal Data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by the Company’s employees in the performance of their duties. The Company’s employees are trained to handle the Personal Data securely and with utmost respect, failing which they may be subject to a disciplinary action.

8. Your responsibilities

You are responsible for making sure that the Personal Data you give the Company or provided on your behalf, is accurate and up to date, and you must tell the Company as soon as possible if there are any updates.

You have some responsibilities under your contract to provide the Company with the Personal Data. You may also have to provide the Company with the Personal Data in order to exercise your statutory rights. Failing to provide the Personal Data may mean that you are unable to exercise your statutory rights.

Certain Personal Data, such as contact details and payment details, must be provided to the Company in order to enable the Company to enter into the contract with you. If you do not provide such Personal Data, this will hinder the Company’s ability to administer the rights and obligations arising as a result of contract efficiently.

9. Revision of the Company’s Privacy Notice

The Company keeps the Privacy Notice under a regular review and thus the Privacy Notice may be subject to change. The date of the last revision of the Privacy Notice can be found on the top of the page.

10. Contact us

If you have any questions in regard to the protection of your Personal Data or if you wish to exercise your rights, please contact: -

Worldlease Care Center Tel. 0 2096 4599 or
Data Protection Officer: E-mail dpo@worldlease.co.th or

Worldlease Company Limited Head Office, 44 CIMB THAI Bank Building, 16th Floor, Langsuan Road, Lumpini, Patumwan, Bangkok 10330

Remark: This Privacy Notice shall be effective on the date on which the relevant provisions of Personal Data Protection Act B.E 2562 (2019) (as amended) becomes effective against the Company.