SAMONGDEE SABAIBRAIN Co., Ltd., operating under the brand “SabaiBrain (สบายเบรน)” (the “Company”), places great importance on protecting and respecting your right to privacy under the Personal Data Protection Act B.E. 2562 (2019), as amended from time to time, and other applicable laws and regulations in force in Thailand (the “PDPA”). The Company is committed to protecting the personal data that it collects, uses and discloses in the course of its business. The Company has obligations regarding personal data protection, privacy and data security under the laws applicable and in force in Thailand. This Policy forms part of the Company’s efforts to achieve the objectives of the Policy and to fulfil its obligations under the PDPA.

Scope of This Privacy Policy

This Privacy Policy for service users, application users, business partners, and sellers of goods or service providers (the “Privacy Policy” or “Policy”) describes the Company’s privacy practices; the purposes for which personal data is collected, used and disclosed; the types of personal data that the Company may collect, use and disclose; how the Company intends to use personal data; the third parties to whom the Company discloses data; how personal data is collected and retained; how you can access and request correction of the personal data the Company holds about you; and how you may make a complaint if you believe the Company has acted in breach of applicable personal data protection laws. Please read this Privacy Policy carefully.

Definitions

Company means SAMONGDEE SABAIBRAIN Co., Ltd.
Personal Data means any information relating to a person that enables the identification of that person, whether directly or indirectly, but does not specifically include information of deceased persons. Information that can distinguish or be traced back to the identity of a person, whether on its own or in combination with other information, is considered personal data.
Sensitive Personal Data means data as defined in Section 26 of the PDPA, including personal data relating to race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data which may affect the data subject in a similar manner.
Data Processing means the collection, use, retention or disclosure of personal data.
Data Controller means a person or juristic person having the authority to make decisions regarding the processing of personal data.
Data Processor means a person or juristic person who processes personal data on the instructions of, or on behalf of, a data controller. A person or juristic person carrying out such activities is not a data controller.

This Policy applies to “personal data” collected from and relating to the following individuals: service users, application users, sellers of goods / service providers, suppliers of goods and/or services, distributors, persons acting on behalf of such persons, and any other relevant persons from whom the Company may collect personal data from time to time. Channels through which personal data is collected include, but are not limited to, documents, email, the Company’s website, any mobile application provided by the Company, and third-party channels through which you have provided your personal data.

This Policy does not form part of any contract or agreement, except to the extent that the Company has expressly stated that it forms part of a contract or agreement.

1. What Types of Data Does the Company Collect from You?

The Company collects “personal data” only to the extent reasonably necessary for its activities. The personal data collected by the Company includes, but is not limited to:

Information about persons acting on behalf of distributors;
Personal data of persons who contact the Company, such as service users, application users, suppliers of goods and/or services, subcontractors, sellers and other service providers, sponsors, advertisers, agents, business partners and business associates (collectively, “Suppliers”); and
Information about officers, staff, employees, personnel and other representatives of the Company with whom the Company is in contact (collectively, “Representatives”).

The types of personal data the Company may collect depend on the nature of your activities with the Company and on where and how the data is collected, and may include the following:

Personal data that can identify you, such as your first name, last name, address, national ID card number, passport number, telephone number, LINE ID, email address, postal delivery address and other contact details, date of birth, gender, age, nationality, occupation, marital status, and biometric data such as facial images, fingerprints and recorded voice;
Health data, such as underlying medical conditions, stress, memory, mood, etc.; criminal records of Representatives assigned to provide services to the Company; and details of sales or services provided by you;
Payment data, such as bank account numbers, bank account details, billing information, credit or debit card information, credit or debit card numbers, and the cardholder’s name (if any);
Where you use the Company’s website or any mobile application, the Company may collect technical data such as your IP address and cookies, and, for applications, the Company may collect location data and information about the mobile device you use;
Usage behaviour data, such as game scores, playing time, comments and suggestions.

Providing your personal data is voluntary. You may choose not to provide the data requested by the Company, but not providing it may mean that the Company is unable to supply certain goods and/or services to you.

Some of the data collected by the Company may be considered “sensitive data”. The Company intends to collect sensitive data from you only where you have given your explicit consent and to the extent reasonably necessary for the Company’s business, or where it is necessary to comply with the law to achieve the purposes specified under the PDPA, or where you have deliberately made the data public. The Company intends to share sensitive data only where it considers it necessary to collect, use or disclose such data, for the following purposes:

To prevent or suppress a danger to the life, body or health of a person where the data subject is incapable of giving consent for whatever reason;
For the legitimate activities, with appropriate safeguards, of foundations, associations or other not-for-profit organisations with political, religious, philosophical or trade union purposes, for their members;
Because the data has been disclosed to the public with your explicit consent;
For the establishment, compliance with, exercise or defence of legal claims;
Where necessary for compliance with the law to achieve purposes relating to scientific, historical or statistical research, or other important public interests.

If you provide the Company with personal data of third parties (such as the name, surname and telephone number of an emergency contact), please inform those third parties of this Privacy Policy and/or obtain their consent.

2. How Does the Company Collect Your Personal Data?

In general, the Company collects personal data directly from you, for example when you send an email or letter to the Company, call or visit the Company, contact the Company, request and/or submit a quotation, request and/or provide information about goods or services, give feedback through online channels, or register or provide contact details for an event, exhibition, sales promotion or other activity through the website, the Company’s systems, or a mobile application created or provided by the Company or any related company (collectively, the “Website”).

The Company does not collect personal data from visitors to its Website, except for data that visitors provide themselves or technical data as described in this Privacy Policy.

From time to time, other persons may provide your personal data to the Company, and you may or may not be directly involved. For example, the Company may collect your personal data from:

Your employer, if they provide your contact details;
Hotels or other venue providers, or their representatives;
Organisations of which you are a member;
Publicly available sources from the private sector, any trade associations and/or government agencies (such as websites); or
Publicly available mailing and marketing contact lists compiled for commercial purposes.

3. How Does the Company Use Your Personal Data?

The Company collects personal data of customers and visitors, Suppliers and Representatives so that it can conduct its business. The Company uses the personal data of customers and visitors, Suppliers and Representatives for purposes including the following:

To communicate with you, to get to know you, to verify your identity, and to verify the accuracy of any information you provide to the Company;
To offer, sell, provide, administer, operate, follow procurement procedures for, and manage goods and/or services; to contact you to acknowledge your orders, deliver goods you have ordered, or provide services to you;
To perform a contract or to enter into a contract between you and the Company; to follow procedures for, manage, complete and give effect to requests or transactions specified in this document or any other document you may submit to the Company from time to time; to analyse any risks to the Company’s business; to collect outstanding payments from you; and to amend or terminate contracts, pursue debt collection, and enforce judgments relating to goods and/or services;
To supply the Company’s goods and/or services to distributors, and to receive goods and/or services from Suppliers and Representatives, including providing or receiving warranty, installation and repair services, advice or consultation, and knowledge about the Company’s goods and/or services;
To improve and develop the Company’s goods and/or services;
To provide support or assistance in supplying the Company’s goods and/or services, such as when distributors, Suppliers or Representatives have enquiries;
To receive goods and/or services, to exercise any rights under a contract you have with the Company, or to obtain information about goods and/or services;
To communicate with you, including communicating administrative and other information about the Company’s goods and/or services or any account you may have with the Company, providing technical support for the Company’s websites and applications, or communicating any future changes to this Privacy Policy;
To process payment information, prepare invoices, collect or make payments, confirm orders, and for accounting, account management and auditing purposes;
To investigate, prevent or take action regarding violations of law; to prevent risks where there is reasonable suspicion of fraud or deception, money laundering, matters affecting national security, unlawful acts, or acts reasonably believed to be unlawful, or matters that may affect the life, health or physical safety of others;
To provide information about other goods and/or services that the Company believes distributors, Suppliers or Representatives may be interested in (distributors, Suppliers or Representatives may notify the Company at any time if they do not wish to receive this type of information);
To maintain the Company’s security;
To assist the Company in conducting its business, such as for advertising, public relations, sales promotions or other communications; to improve goods and/or services; to organise training; to organise marketing activities; to carry out statistical or market analysis and consumer surveys; and to manage information systems and to test, develop and maintain security systems and controls;
For the purposes of corporate restructuring and corporate transactions, as a result of which your personal data may be transferred or disclosed as part of the purchase or sale of a business, or as part of an offer to buy or sell a business;
To comply with regulations and for audits of the Company’s business (both internal and external);
To comply with the requirements of the Company’s internal policies;
For the purposes of storing, recording, backing up or destroying personal data;
To comply with the requirements of applicable laws, rules, regulations, agreements or policies established by government regulators, law enforcement agencies, government agencies, dispute resolution bodies or any authority supervising the Company’s business;
To assist for law enforcement purposes or investigations by or on behalf of the Company, by police officers, or by government or other regulatory agencies in any country or jurisdiction, and to perform reporting duties and comply with requirements prescribed by law or agreed with government or other regulatory agencies in any country or jurisdiction;
For quality and training purposes, when the Company’s communications are recorded;
For general administration relating to any of the above purposes; and
For any other necessary actions directly related to any of the above purposes.

If the Company collects your personal data for any other purpose, it intends to inform you of that purpose before or at the time it collects the data.

Direct Marketing

In addition, where it has obtained your consent, the Company may use your personal data to provide you with information about events, sales promotions, goods or other services that the Company believes may interest you. You may notify the Company at any time if you do not wish to receive such communications, by contacting the Company using the contact details provided at the end of this Privacy Policy. Your request may have certain consequences, which the Company will explain to you upon receiving your request; for example, after acting on your request, the Company may no longer be able to provide certain services you have requested. The Company may, however, continue to contact you for other purposes relating to the goods and/or services it provides to you, or as described elsewhere in this Privacy Policy.

4. When and How Will the Company Disclose Your Personal Data to Others?

The Company does not sell personal data to third parties. However, the Company may share personal data with third parties in anonymised form, or as aggregated data from which the data subject cannot be identified.

The Company intends to limit the disclosure of personal data to the original purpose for which it was collected, or to related purposes only, for the Company’s business operations and administration, including where disclosure is necessary to supply the goods and/or services you have requested, to assist the Company in conducting its business, or for security reasons, as detailed above.

In addition, the Company may from time to time disclose your personal data to external organisations for the same purposes for which it was collected, or for related purposes, for example where disclosure is necessary to supply goods, provide services or organise activities you have requested, to assist the Company in conducting its business, or for security reasons or to comply with the law.

The Company may provide your personal data to the following:

Affiliated companies, wherever they are located in the world;
Organisers, publicists and sponsors of events, functions or exhibitions;
Hotels or other venue providers and their representatives, in connection with events, functions or exhibitions;
The Company’s customers in connection with events, functions or exhibitions;
Subcontractors, service providers, Suppliers and other agents acting on behalf of or engaged by the Company, such as organisations that supply goods or services related to events, banking or financial services, internet hosting, applications, cloud systems or data networks, event and exhibition registration services, domestic and international travel services, security services, auditing services, legal services, insurance services, market research services, and email or postal management services, as well as representatives and agents who sell or promote goods and/or services on behalf of the Company, and auction management services. Some of these organisations may be located outside Thailand, in countries that may have no applicable personal data protection laws, or laws that are inadequate or not equivalent to Thailand’s personal data protection laws;
Banks or financial institutions, as the case may be;
Any person to whom you have consented to the disclosure of your personal data;
Actual or prospective buyers or sellers, if the Company sells all or part of its business, merges, or acquires another business or company; and
Any person or government agency under the law, by court order, or any other authority legally empowered to supervise the Company’s business, which requires the Company to disclose personal data to them.

You consent to and acknowledge that the Company may engage third parties to carry out the purposes described above, in whole or in part, or to develop or maintain the Company’s systems. In such cases, the Company will control and put measures in place to ensure that those third parties retain and use personal data only in accordance with this Policy, and that they strictly comply with the terms and conditions for the security of your personal data and with personal data protection laws.

5. Data Retention

The Company will collect, use, disclose and retain your personal data throughout the period of its relationship with you, for example throughout the period in which goods are bought or sold or the Company’s services are provided. After you end your relationship with the Company, the Company will continue to retain information about you, including personal data, for as long as necessary for the purposes described above. The Company will retain your personal data for no longer than 20 (twenty) years from the end of the relationship, unless the Company needs to retain it for longer than 20 (twenty) years and the law permits it to do so.

The Company may store personal data on a cloud network, currently using servers located in Singapore. Storing data in this way may involve transferring data outside Thailand, in accordance with the personal data protection laws applicable to your personal data.

6. The Company’s Website

When you visit the publicly accessible pages of the website of the Company or its affiliates, the website’s server will record your visit and collect the following information:

Your IP address (in general terms, a unique identifier assigned to your computer when it connects to the internet);
The search terms used;
The operating system and internet browser you are using; and
The data you download (such as web pages, document files or other software) and the time of download.

This information is used for statistical purposes only, to help the Company understand which parts of its website are visited most by users, which helps the Company know how to improve its goods and/or services.

If you contact the Company, register through any of the Company’s websites, or email the Company, the Company intends to use your personal data only to fulfil your request or to respond to your enquiry. In addition, if you give your consent as required by applicable law, the Company may add your email address to its mailing list. However, you may notify the Company if you no longer wish to receive information about the Company, its events, sales promotions, any direct marketing communications, or its goods and/or services.

For restricted-access areas of the website, the Company uses “cookies”, which are tools that recognise your device and store certain information during visits to the website from the same device. The Company’s website uses cookies to respond to you better when you use certain parts of the website. The data the Company collects and analyses includes information about your computer and connection, such as the type and version of browser used, the type and version of browser plug-ins used, the operating system, and the language selected. This data is not linked to any personal data and cannot be used to identify any individual user. You can adjust your browser settings to refuse cookies or disable them if you wish.

It is important that you prevent others from knowing your password and from accessing your computer without authorisation. You should always log out if you access the Company’s website from a shared computer.

Other Websites

The Company’s website may contain links to websites operated by third parties, including other organisations. In such cases, the Company does not control those websites and is not responsible for the data and privacy practices of their operators.

In addition, the Company may manage or provide websites or mobile applications for third parties, including websites or mobile applications for customers to showcase their work, events or exhibitions. These websites belong to other third parties or to the Company’s customers, and such mobile applications are made solely for the showcases, events or exhibitions of those third parties or customers. The Company is not responsible for the privacy practices of those third parties or customers.

Before disclosing your personal data on a website linked from the Company’s website, or on any website or mobile application managed or provided by the Company for a third party or customer, the Company recommends that you read the privacy policy and the terms and conditions of use of that website or application.

7. Minors

The Company cannot know the age of visitors to its website. If you are the parent or guardian of a minor who has provided their personal data to the Company without your knowledge or consent, you may contact the Company and ask it to delete that data in accordance with this Privacy Policy. For this purpose, a minor means a person under 20 (twenty) years of age.

To the extent permitted by applicable personal data protection laws, when you use or access any of the Company’s websites, or provide personal data to the Company, you are deemed to have:

Consented to the Company collecting, using and processing your personal data for the purposes, by the methods and in accordance with the other details specified above (which may change from time to time), unless and until you notify the Company that you withdraw that consent. You may withdraw your consent at any time by notifying the Company in writing. The Company may decline to act on your request where permitted by law; and
Consented to the Company disclosing or transferring your personal data to third parties and affiliated companies for the purposes, by the methods and in accordance with the other details specified above. You may withdraw your consent at any time by notifying the Company in writing.

If you provide the Company with personal data of another person, you must first obtain that person’s consent, and you represent and warrant that you have obtained such consent or are otherwise entitled to provide that person’s personal data to the Company. When you provide another person’s personal data to the Company, you are deemed to warrant that the person is aware of and has consented to the terms of this Privacy Policy.

If applicable personal data protection laws require additional consent, the Company or any third-party service provider to the Company will obtain your consent for the collection and use of your personal data at the time it is collected.

If you do not permit the collection, use, processing, transfer or disclosure of certain types of personal data as notified or requested by the Company, the Company may be unable to perform its legal obligations or to do business with you, in which case the Company will inform you. In most cases, you are required to provide your personal data to the Company so that it can fulfil your requests or supply the goods and/or services you have requested. You may, however, notify the Company if you no longer wish to receive promotional and marketing content, communications, promotional offers, newsletters or other similar communications from the Company. The Company will act on your request within a reasonable time after receiving your written notice.

9. Your Rights

Right to withdraw consent You have the right to withdraw your consent at any time, unless otherwise provided by law. Withdrawing consent does not affect the processing of personal data to which you lawfully consented before the withdrawal.
Right to erasure or destruction of personal data You have the right to request that the Company erase or destroy your personal data in its possession or control, or anonymise it so that you cannot be identified.
Right to data portability You have the right to request that the Company transfer your personal data, in a format that is readable or commonly usable by automated tools or devices, to another data controller, subject to the exceptions provided by law.
Right to object You have the right to object to the collection, use or disclosure of your personal data, or to request that the Company suspend the use of such personal data. The Company will act on your request in accordance with the relevant provisions of law.
Right to temporarily suspend the use of your personal data (right to restrict processing): You have the right to request that the Company restrict the processing of your data. The data controller may continue to store your personal data but may no longer process it, unless you give your consent or an exemption applies under the law.
Right of access You have the right to request access to and a copy of your personal data. The Company will act on your request within 30 (thirty) days from the date of receiving it, unless otherwise provided by law.
Right to rectification You have the right to request that the Company ensure your personal data is accurate, complete and up to date. At every stage of its operations, the Company will check, as far as possible, that your personal data is accurate, complete and up to date.
Right to lodge a complaint You have the right to lodge a complaint with the competent officials or the authority responsible for supervising personal data protection.

10. Contact the Company

If you have any questions about this Privacy Policy, or wish to exercise your rights regarding the processing of your personal data, please contact hello@sabaibrain.com. The Company may charge a reasonable fee for acting on the above requests.

11. Review of This Privacy Policy

The Company may review and update this Privacy Policy from time to time, for example to keep it consistent with amendments to the law, including personal data protection laws, or with changes to the Company’s technology. You should check the Privacy Policy displayed on the Company’s website periodically so that you are aware of any updates. When this Policy is updated, the Company will notify you by displaying the word “Updated” next to the Privacy Policy link on the Company’s website for 30 (thirty) days, and may request your consent (if necessary).

Privacy Policy