Privacy Notice

Date: 28 January 2021

Dear Customers,
Worldlease Company Limited (“Company”) values a privacy and strives for protecting your personal data or personal data relating to individuals connected to your business (“Personal Data”) based on the laws of Thailand.
This Privacy Notice explains: -

1. Collection of Personal Data
The Company collects many different kinds of Personal Data, depending on various circumstances and nature of requested products, services and/or transactions performed.
The Company collects the Personal Data about you from a variety of sources, including but not limited to:-

The Company sometimes collect the Personal Data from additional online and offline sources including commercially available third-party sources, such as credit reporting agencies (including the National Credit Bureau). The Company may combine this information with the Personal Data the Company has collected about you under this Privacy Notice.
In some instances, the Company may engage unaffiliated third parties to collect the Personal Data about your online activities when you visit the Company’s online sources. The Company may also use the Personal Data collected across non-affiliated websites for the purpose of serving you advertisements related to your browsing behaviour. While the Company engages in this practice, the Company will provide an appropriate notice and choice so that you can opt-out such collection.
The categories of Personal Data about you that the Company collects, subject to the applicable law, include but not limited to: -

2. Use of Personal Data
The Company may collect use and/or disclose your Personal Data only if the Company have proper reasons to do so. This includes sharing it outside the Company.
The Company will rely on one or more of the following lawful grounds when collecting, using and/or disclosing your Personal Data: -

The purposes and legal basis for which the Company may collect, use and/or disclose your Personal Data are as follows: -

Purposes of data collection, use and/or disclosure

Lawful basis for collection, use and/or disclosure

Provision of products and services

  • To verify, authenticate you and perform credit reference check
  • Contractual basis








  • Consent
  • Legal obligation
  • To deliver the Company’s services and/or products
  • To carry out and manage a payment
  • To manage the Company’s relationship with you or your business
  • To communicate with you via email, telephone, text message, social media, post or in person about the Company’s products and/or services, information, notification (non-marketing purposes), e.g., notification of branch closure.
  • To facilitate insurance and financial services
  • To analyze your credit and repayment behavior scoring as part of a lending process
  • To collect, use and/or disclose the sensitive Personal Data which are religious, health record or biometric data, e.g., facial simulation, fingerprint simulation, iris simulation, voice identification, etc., for the purpose of identity proof and verification and/or transactions via digital means, branches, websites or any other modes, etc.

Fulfilling legal obligations

  • To submit regulatory reports to relevant authorities
  • Legal obligation
  • To prevent and detect money laundering or financing of terrorism and comply with regulation relating to sanctions and embargoes through the Company’s Know Your Customer (KYC) process (to identify you, verify your identity, screen your details against sanctions lists and determine your profile) and perform a Client Due Diligence (CDD) as prescribed by anti-money laundering law and other relevant law
  • To comply with applicable laws and regulations

Provision of customer support

  • To ensure customer satisfaction and provide professional customer support
  • Contractual basis
  • To communicate with you through various channels
  • To respond to inquiries and keep records of interactions, comments and/or complaints
  • To process your orders or requests such as data correction, request of document, etc.

Business operation

  • To identify issues with products and services
  • Contractual basis
  • Legitimate interest
  • To carry out and improve business activities
  • To do statistical reports, market research, analytic report (non-marketing/promoting product and services)
  • To plan the improvements to the existing products and services
  • To carry out and improve a business performance

Security and risk management

  • To prevent crimes and manage security (for example, use of CCTV (which may collect / record your photos, videos or voice)
  • Legal obligation
  • Legitimate interest
  • Contractual basis
  • To investigate, report and seek for a financial crime prevention
  • To manage risk
  • To do internal audits
  • To seek and/or provide legal advisory within the Company


  • To develop and carry out any marketing activities
  • Consent
  • Legitimate interest
  • To communicate with you via email, telephone, text message, social media, post or in person about the Company’s, CIMB group and/or trusted partners’ products and/or services that you may be interested in
  • To personalize the marketing messages and send to you
  • To let the Company’s trusted partners send you the information regarding the products and/or services that you may be interested in
  • To study how you use the products and/or services (analysis for promoting product/service)
  • To test, research, analyze and develop new products/ new features of products and/or services

When the Company relies on the legitimate interests as the reason for collecting, using and/or disclosing the Personal Data, it has considered whether your fundamental rights are overridden by the Company’s legitimate interests and has concluded that they are not.
If you fail to provide your Personal Data to the Company
Where the Company is required by law to collect your Personal Data or need to collect your Personal Data under the terms of a contract the Company has with you and you fail to provide your Personal Data when requested, the Company may not be able to perform obligation under the contract the Company has with you or plan to enter into with you (for example, to provide you with the Company’s account opening services). In this case, the Company may have to decline to provide the relevant services, but the Company will notify you if this is the case at the time your Personal Data is collected.

3. Disclosure of Personal Data
The Company may share your Personal Data with others where it is lawful to do so, including where the Company or other person: -

The Company may share your Personal Data for the above purposes with others, including: -

There may be instances which the Company may share non-personally identifiable information about you to third parties, such as advertising identifiers or one-way coding (cryptographic hash) of a common account identifier, such as a contact number or e-mail address, to enable the conduct targeted advertising.
Except as described in this Privacy Notice, the Company will not use the Personal Data for any purposes other than the purposes as described to you in this Privacy Notice. Should the Company intend to collect, use or transfer additional information which are not described in this Privacy Notice, the Company will notify you and obtain your consent prior to the collection, use and disclosure unless the Company is permitted to do so without your consent under the law. You will also be given the opportunity to consent or to decline approval of such collection, use and/or transfer of your Personal Data.
The Company will continue to adhere to this Privacy Notice with respect to the information the Company has in its possession relating to prospective, existing and former clients and investors.

Cross-border Transfer of Personal Data
Your Personal Data may be transferred to and collected and/or used in other countries, including Malaysia.
Such countries may not have adequate level of protection for the Personal Data as will be prescribed by the Personal Data Protection Committee of Thailand. When the Company do this, the Company will ensure that the transfer has an appropriate level of protection and that the transfer is lawful. For example, your Personal Data may be shared to other CIMB group companies in accordance with the Company’s Binding Corporate Rules (BCRs) or other relevant contractual arrangements, which require all CIMB group companies to follow the same rules or terms when collecting, using and/or disclosing your Personal Data. If you wish to request for a copy of the Company’s BCRs, you can do so by contacting the Company at
The Company may need to transfer the Personal Data in this way to carry out the Company’s contract with you, fulfill the legal obligations, protect the public interests and/or for the Company’s legitimate interests. In some countries, the law might compel the Company to share certain Personal Data, e.g., with tax authorities or National Bank. Even in these cases, the Company will only share the Personal Data with people who have the right to see it.

4. Retention of Personal Data
The Company will only retain your Personal Data for as long as it is necessary to carry out the purposes for which it was collected, that is, for the purpose of satisfying any regulatory reporting requirements, carrying out the Company’s service per your request or compliance with the applicable laws.
The Company will keep your Personal Data for up to 10 years after you stop being the Company’s customer to ensure that any contractual dispute that may arise can be processed within that time. However, in the event of regulatory or technical reasons, the Company may keep your Personal Data for more than 10 years. If the Company does not need to retain your Personal Data for longer than it is legally necessary, the Company will destroy, delete or anonymize it (so that it can no longer be associated with you).
Where you receive the products and/or services from third party, e.g., insurance company, who has been introduced to you by the Company, such third party may keep your Personal Data in accordance with additional terms and conditions applying to their product and/or services.

5. Accuracy of your Personal Data
The Company need your help to ensure that your Personal Data is current, complete and accurate. Please inform the Company of any changes to your Personal Data by: -

The Company will occasionally request the updates from you to ensure the Personal Data the Company uses toulfill the purposes of collection, use and/or disclosure are current, accurate and complete.

6. Your rights as data subject
Under certain circumstances, you have rights under data protection law in relation to your Personal Data. It is the Company’s policy to respect your rights and the Company will act promptly and in accordance with any applicable law, rule or regulation relating to the collection, use and/or disclosure of your information.
Details of your rights are set out below: -

Customers are able to file the complaint with a related government authority, including but not limited to, the Personal Data Protection Committee of Thailand in the case where, in your view, the Company, the Company’s employee or contractor violates or fails to comply with the Personal Data Protection Act of Thailand B.E. 2562 (2019) or notifications issued thereunder.

You may exercise any of your rights at any time using the contact details set out in 10. (Contact us) below. The Company may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, the Company may refuse to comply with your request in these circumstances.

The Company may need to request specific information from you to help the Company confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that your Personal Data is not disclosed to any person who has no right to receive it. The Company may also contact you to ask you for further information in relation to your request to speed up the Company’s response.

The Company tries to respond to all legitimate requests within 30 days. Occasionally, it may take the Company longer than 30 days if your request is particularly complex or you have made a number of requests. In this case, the Company will notify you and keep you updated.

Handling of complaints
In the event that you wish to make the complaint about how the Company collects, uses and/or discloses your Personal Data, please contact the Company at our branches or Worldlease customer relations Tel. 0 2675 6300 Ext.192 and the Company will try to consider your request as soon as possible. This does not prejudice your right to file the complaint with a government authority that has a data protection authority.

7. Security of your Personal Data
Information is the Company’s asset and therefore the Company places a great importance on ensuring the security of your Personal Data. The Company regularly reviews and implements up-to-date physical, technical and organizational security measures when collecting, using and/or disclosing your Personal Data. The Company has internal policies and controls in place to ensure that your Personal Data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by the Company’s employees in the performance of their duties. The Company’s employees are trained to handle the Personal Data securely and with utmost respect, failing which they may be subject to a disciplinary action.

8. Your responsibilities
You are responsible for making sure that the Personal Data you give the Company or provided on your behalf, is accurate and up to date, and you must tell the Company as soon as possible if there are any updates.
You have some responsibilities under your contract to provide the Company with the Personal Data. You may also have to provide the Company with the Personal Data in order to exercise your statutory rights. Failing to provide the Personal Data may mean that you are unable to exercise your statutory rights.
Certain Personal Data, such as contact details and payment details, must be provided to the Company in order to enable the Company to enter into the contract with you. If you do not provide such Personal Data, this will hinder the Company’s ability to administer the rights and obligations arising as a result of contract efficiently.

9. Revision of the Company’s Privacy Notice
The Company keeps the Privacy Notice under a regular review and thus the Privacy Notice may be subject to change. The date of the last revision of the Privacy Notice can be found on the top of the page.

10. Contact us
If you have any questions in regard to the protection of your Personal Data or if you wish to exercise your rights, please contact: -
Text Box: •	Any Customer Service Officer at any of the Company’s branches or  •	Worldlease customer relations Tel. 0 2675 6300 Ext. 192 or  •	Data Protection Officer: E-mail or  •	Worldlease Company Limited Head Office, 43 Thai CC Tower, 34th Floor, Room#346-9, South Sathorn Road, Yannawa, Sathorn, Bangkok 10120

Remark: This Privacy Notice shall be effective on 1 June 2021.