Mod Gut Co., Ltd. (the “Company”) as a Data Controller under the Personal Data Protection Act B.E. 2562 (“Personal Data Protection Act”), the Company are obliged to comply with the Personal Data Protection Laws and Regulation. Therefore, the processing of personal data (which includes collecting, recording, organizing, preserving, changing, using, disclosing or transmitting information, disseminating or any other action to make data usable for the purposes for which it was used) of the Data Subject (or you), the Company hereby notifies you of the manners on which the Company shall handle your Personal Data, as follows:

Collection of Personal Data

The Company collects your Personal Data directly through contact of the Company and the Data Subject through various channels such as website, telephone, e-mail, LINE application, etc.

Personal Data collected

• Name, surname, and other contact information such as address, e-mail address, telephone number, Mobile phone number and LINE ID

• User account information such as username, password used to access the website.

• Credit and debit card information, transaction information including price, payment method and other payment details

• Personal information provides to the Company when the Data Subject interact with the Company through various online channels such as operating system, browser, settings, device type used or data type Uniform Resource Locator, IP Address, etc.

Cookies

The Company uses cookies to collect Personal Data while you use the Company’s website, as set out in the Company’s Cookie Policy. Further details are available on: https://www.modgut.com/

Duration of data processing

The Company will collect and retain the Personal Data throughout the period which the purpose of data processing can still be established. Afterwards, the Company shall delete or destroy such data unless it is required to retain such data under legal requirement or for the protection of the Company’s lawful rights. In general, the Company may retain the Personal Data not exceeding 10 years unless the law requires otherwise or the Company can establish other necessary grounds for retaining such data e.g., for security purpose, for prevention of fraud or misconduct, or for accounting purposes.

Upon expiration of the permitted period, the Company shall delete or destroy your Personal Data from the Company’s database or server or make such data unidentifiable.

Purposes of collection

Your Personal Data collected by the Company will be used, and shall not be used for any other purposes, only for

• Performing the Company’s contractual obligation – between the Data Subject (customer) and the Company and for the performance of duties under the said contract by the Company

• Complying with the Company’s legal obligation – for the Company’s operations by taking into account the fundamental rights of the Data Subject, such as communication for the completion of the contractual transaction between the customer and the Company or for the exercise of legal claims, etc.

• The Company’s legitimate interests – or comply with the laws and regulations.

In the event that the Company uses services from an external Data Processors, the Company will process Personal Data of Data Subjects for performing the Company’s contractual obligation, for complying with the Company’s legal obligation, for the Company’s legitimate interest or as the Data Subject has given consent (If necessary) to the company. The Company will not disclose or cause the information of the Data Subject to be disclosed, displayed, or made to appear in any other manner inconsistent with the purpose of performing the Company’s contractual obligation, complying with the Company’s legal obligation, Company’s legitimate interest or as the Data Subject has given consent unless the consent of the Data Subject has been obtained or in cases where the Personal Data Protection Act requires that it be possible to do so without the consent of the Data Subject.

If the Data Subject is unable to provide Personal Data necessary for the processing of Personal Data for performing the Company’s contractual obligation, for complying with the Company’s legal obligation and for the Company’s legitimate interest, the Company will not be able to perform its contract with the Data subject.

The Company will process strictly process your personal data by complying with the relevant laws. Consent given to the Company by the Data Subject can be revoke at any time.

Disclosure of Personal Data

The Company shall not disclose your Personal Data to other persons except in the following cases

• Third Party Service Providers – The Company may disclose your Personal Data to an external service provider for certain activities, such as providing server services for websites, data analysis, processing and receiving payment, making an order, providing information technology infrastructure services, etc.

• Financial Institutions – The Company may disclose your Personal Data to financial institutions, banks, credit card companies, insurance companies or debt collection agency as necessary to make and receive payments as requested. The Company will only disclose your Personal Data to persons with authorized access as required by law and such authorized access can be proven.

• Relevant Government Agencies – The Company may disclose your Personal Data to relevant government agencies for legal compliance, such as reporting to relevant regulatory bodies or compliance with any other legal requirements obligated to be comply with.

The Company will disclose personal information to recipients abroad only if required by the Personal Data Protection Act.

In the event that it is necessary to disclose your Personal Data to a third party, the Company will take an appropriate step to ensure that the third parties have a sufficient preventive measure to protect your Personal Data not to be lost, unauthorizedly access, inappropriately use, modify or disclose.

Rights of Data Subject 

Rights of subject data can be enforced by Data Subject by issuing notice in writing or by means of electronics mails to notify such use of rights to the Company;  

• be informed of the Company’s data processing; – In the event that the Company has processed data inappropriately for the purpose or in addition to any consent the Data Subject has previously provided, the Company will notify and/or seek consent from the Data Subject prior to processing of Personal Data in addition to the aforementioned purposes.

• access your Personal Data including to obtain copy of such Personal Data or to be informed the source of collection; – The Data Subject has the right to request access and obtain a copy of the Personal Data concerning the Data Subject which is under the Company’s responsibility or request disclosure of the acquisition of such Personal Data.

• request the Company to correct or update your Personal Data to avoid confusion; – The Data Subject has the right to request the Company to update the Personal Data to be accurate, current, complete and not misleading.

• request the Company to transfer Data– Where it is supported by the Company’s system, the Data Subject has the right to obtain his or her Personal Data in a readable or generally usable format with a tool or device that works automatically and is able to use or disclose the Personal Data with an automated method.

• request the Company to delete, eradicate or make a Personal Data unidentifiable; -The Data Subject has the right to request the Company to delete or destroy or make Personal Data non-identifiable to the person who owns Personal Data in any of the following cases: (a) it is no longer necessary to collect, use or disclose Personal Data for the purpose; (b) when the Data Subject withdraws their consent to the collection, use or disclosure of Personal Data; The Company is no longer legally authorized to process that data (c) when the Data Subject objected to the processing of Personal Data, or (d) when the Personal Data was unlawfully processed.

• request the Company to suspend the use of your Personal Data; -The Data Subject has the right to request the Company to suspend the use of Personal Data as follows: (a) when the Data Subject is being reviewed as requested by the Data Subject, improvements are made to ensure that Personal Data is accurate, current, complete and does not cause misunderstandings (b) when it is data that needs to be erased/destroyed in accordance with clause 7.5 but the Data Subject requests to suspend the use of the data instead; (c) when Personal Data is no longer necessary for retention but the Data Subject request the Company to keep the information first in order to establish a legal claim, compliance with or exercise of legal claims or statutory defense of claims; (d) when the Company is in the process of proving the collection of Personal Data; or is in the process of reviewing the processing of Personal Data for the purposes required by law.

• object the collection, use or disclose of your Personal Data; – The Data Subject has the right to object to the collection, use or disclosure of such Personal Data.

• withdraw any consent given to the Company – The Data Subject has the right to withdraw their consent at any time such withdrawal of consent will not affect any processing of Personal Data to which the Data Subject has previously given consent. The Company will notify the Data Subject of the impact of the withdrawal of consent.

In this regard, the Company has the right to deny any request of the Data Subject in case any data processing is for legal compliance purposes or by the court orders, or the Data Subject’s request may adversely affect the right and privacy of other persons, or it is for statistic research which the Company has deployed appropriate measure to protect security of the Personal Data, or it is for the establishment or enforcement of the Company’s right of claim.

The Company’s contact details

In case of any doubt or wish to exercise the rights set forth in this notice of processing. You can contact the Company via:

Mod Gut Co., Ltd.

Personal Data Protection Officer: Mr. Teerapong Leelanupab

Address: No. 349, SJ Infinite One Business Complex Building, 31st Floor, Room 3106

Vibhavadi Rangsit Road, Chomphon Subdistrict, Chatuchak District, Bangkok

Phone number: 02 026 8956

Email: [email protected]

Please put the email’s subject preceded by “[pdpa]”. For example, “[pdpa] remove my account from the system.”

Remark: The Company reserve all rights to modify or change details of this notice and the Company shall notify the Data Subject of such details in accordance with its legal obligations under the Personal Data Protection Act.

Last modified on 6 September 2022