We are regulated by many laws, rules, regulations, and orders of any competent governmental, supervisory or regulatory authorities, and to fulfil our legal and regulatory requirements, it is necessary to collect, use or disclose your personal data for the following purposes, which include but not limited to:

a) compliance with the PDPA and any amendment thereof;

b) compliance with laws (e.g. Financial Institution Business Law, Anti-Money Laundering Laws, Prevention and Suppression of Financial Support to Terrorism and the Proliferation of Weapons of Mass Destruction Laws, and other laws to which we are subject both in Thailand and in other countries), including conducting identity verification, background checks and credit checks, Know Your Customer (KYC) process, Customer Due Diligence (CDD) process, other checks and screenings (including screening against publicly available database of regulatory authorities and/or official sanctions lists), and ongoing monitoring that may be required under any applicable law; and/or

c) compliance with regulatory obligations and/or orders of authorized persons (e.g. orders by any court of competent jurisdiction or of governmental, supervisory or regulatory authorities or authorized officers).

We will collect, use or disclose your personal data in accordance with the request and/or agreement made by you with us, for the following purposes, which include but not limited to:

a) process your request prior to entering into an agreement, consider for approval and provide products and/or services, deliver our products and/or services to you, provide advices and deal with all matters relating to the products and/or services, including any activities that if we do not proceed, then our operations or our services may be affected or may not be able to provide you with fair and ongoing services;

b) authenticate when entering into, doing or executing any transactions;

c) carry out your instructions (e.g. making transactions relating to food order, reservation of accommodations, tours, flight tickets or cars, purchase of tickets for events, attractions, or activities transactions, convenience goods order, delivery of goods, processing your applications and/or your transactions, fulfilling a request for utilization of products and/or services, responding to your enquiries or feedbacks, or resolving your complaints);

d) provide mobile applications and other online product platforms;

e) track or record your transactions;

f) produce reports (e.g. transaction reports requested by you or our internal reports);

g) notify you with transaction alerts;

h) recover the money which you owe (e.g. when you have not paid for outstanding fees);

i) carry out account maintenance and operations relating to your user accounts, including but not limited to processing your applications or requests for services or products, processing your transactions, generating statement of your user accounts, and operating and closing your user accounts;

j) carry out or make transactions and/or payments (e.g. processing payments or transactions, fulfilling transactions, billing or processing activities, managing your relationship with us and administering your account with us);

k) enforce our legal or contractual rights; and/or

l) provide IT and helpdesk supports, create and maintain codes and user accounts for you, manage your access to any systems to which we have granted you access and remove inactive accounts.

We rely on the basis of legitimate interests by considering our benefits or third party’s benefits with your fundamental rights in personal data which we will collect, use or disclose for the following purposes, which include but not limited to:

a) conduct our business operation and the business operation of companies in SCBX Group (e.g. to conduct compliance audit, to conduct risk managements, to conduct finance and accounting managements, to conduct financial audits, to conduct internal operation management, to monitor, prevent, and investigate fraud, money laundering, terrorism, misconduct, or other crimes, including but not limited to carrying out the creditworthiness checks of any persons related to our corporate customer, which may not be required by any governmental or regulatory authorities, and authenticating your identity to prevent such crimes);

b) conduct our relationship managements (e.g. to serve customers, to conduct customer survey, to manage customer segmentation, to handle complaints);

c) ensure security (e.g. to maintain CCTV records, to register, exchange identification card and/or take photo of visitors before entering into our building areas);

d) develop and improve our products, services and systems to enhance our services standard and/or for the greatest benefits in fulfilling your needs, including to conduct research, analyse data and offer products, services and benefits including customer data collection and processing with Google Analytics tool suitable to you by considering the fundamental rights in your personal data. If you do not wish to receive the offering of products, services and benefits from us, you can contact us, details as specified in No.11;

e) record images and/or voices relating to the meetings, trainings, seminars, recreations or marketing activities;

f) in case of our corporate customer, we will collect, use and disclose personal data of directors, authorized persons or attorneys;

g) ensure business continuity;

h) handle claims and disputes, file lawsuits and process the relevant legal proceedings;

i) contact you prior to your entering into a contract with us;

j) protect against security risks (e.g. monitoring network activity logs, detecting security incidents, conducting data security investigations, and otherwise protecting against malicious, deceptive, fraudulent, or illegal activity);

k) comply with applicable foreign laws;

l) carry out research, plan and conduct statistical analysis (e.g. data analytics, assessments, surveys and reports on our products and/or services and your behavior);

m) organize our promotional campaigns or events, conferences, seminars, and company visits;

n) facilitate financial audits to be performed by auditors;

o) receive advisory services from legal counsels, financial advisors, and/or other advisors appointed by you or us;

p) in the event of sale, transfer, merger, reorganization, or similar event, disclose and transfer your personal data to one or more third parties as part of that transaction;

q) maintain and update lists andor directories of the customers (including your personal data) and keep contracts and associated documents in which you may be referred to; and/or

r) comply with reasonable business requirements (e.g. management, training, auditing, reporting, control or risk management, statistical and trend analysis and planning or other related or similar activities, implementing business controls to enable our business to operate, and enabling us to identify and resolve issues in our IT systems to keep our systems secured, performing our IT systems development, implementation, operation and maintenance).

In certain cases, we may ask for your consent to collect, use or disclose your personal data to maximise your benefits and/or to enable us to provide services to fulfil your needs for the following purposes, which include but not limited to:

a) collect, use or disclose your sensitive personal data as necessary (e.g. to use your identification card photo (which contains your sensitive personal data, namely religion and/or blood type) or criminal records or similar information of criminal record for verification of your identity before continuing the transaction and for Know Your Customer (KYC) process); including incase of Rider and Driver for contract and background check in on boarding process as well as control and supervise behavior and take disciplinary action against rider or driver who breaches the laws;

b) collect and use your personal data and any other data to conduct research and analyze for the benefits in developing products and services to fulfil your needs and/or to contact you for offering products, services and benefits suitable to you;

c) contact you to provide advice and offer our products or services which may interest you (in case the consent is required under the PDPA);

d) disclose your personal data and any other data to companies in SCBX Group as shown on https://www.scbx.com/en/affiliates-financial-business-group.html and our trusted business partners for the following purposes: (1) researching, conducting statistical data, developing, analyzing products, services, and benefits to fulfil your needs; and (2) contacting you for offering or providing products, services and benefits suitable to you;

e) send or transfer your personal data and sensitive personal data overseas, which may have inadequate personal data protection standards (unless the PDPA specifies that we may proceed under other lawful basis or without obtaining consent);

f) when you are classified as a minor, incompetent or quasi-incompetent whose consent must be given by their parent, guardian or curator (as the case may be) (unless the PDPA specifies that we may proceed without obtaining consent); and/or

g) other activities which we may require your consent.

Apart from the lawful basis which we mentioned earlier, we may collect, use or disclose your personal data based on the following lawful basis:

a) prepare historical documents or archives for the public interest, or for purposes relating to research or statistics;

b) prevent or suppress a danger to a person’s life, body or health; and/or

c) necessary to carry out a public task, or for exercising official authority.

a) Data obtained by us from companies in SCBX Group, business partners, and/or any other persons who we have relationship with;

b) Data obtained by us from persons related to you (e.g. your family, friends, referees);

c) Data obtained by us from corporate customers as you are director, authorised person, attorney, representative or contact person;

d) Data obtained by us from governmental authorities, regulatory authorities, financial institutions and/or third-party service providers (e.g. data that is publicly available, data that relates to transactions); and/or

e) Data obtained by us from insurance companies and/or other persons in relation to insurance policy or claim for compensation.

You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.

You have the right to rectify your inaccurate personal data and or to update your incomplete personal data.

You have the right to request us to delete, destroy or anonymise your personal data, unless there are certain circumstances where we have the legal grounds to reject your request.

You have the right to request us to restrict the use of your personal data under certain circumstances (e.g. when we are pending examination process in accordance with your request to rectify your personal data or to object the collection, use or disclosure of your personal data, or you request to restrict the use of personal data instead of the deletion or destruction of personal data which is no longer necessary as you have necessity to retain it for the purposes of establishment, compliance, exercise or defense of legal claims).

You have the right to object the collection, use or disclosure of your personal data in case we proceed with legitimate interests basis or for the purpose of direct marketing, or for the purpose of scientific, historical or statistic research, unless we have legitimate grounds to reject your request (e.g. we have compelling legitimate ground to collect, use or disclose your personal data, or the collection, use or disclosure of your personal data is carried out for the establishment, compliance, or exercise legal claims, or for the reason of our public interests).

You have the right to receive your personal data in case we can arrange such personal data to be in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means. Also, you have the right to request us to send or transfer your personal data to third party, or to receive your personal data which we sent or transferred to third party, unless it is impossible to do so because of the technical circumstances, or we are entitled to legally reject your request.

You have the right to withdraw your consent that has been given to us at any time pursuant to the methods and means prescribed by us, unless the nature of consent does not allow such withdrawal. The withdrawal of consent will not affect the lawfulness of the collection, use, or disclosure of your personal data based on your consent before it was withdrawn.

You can review and change your consent to use or disclose your personal data for marketing purposes through channels as specified in No. 11, or through our application, our branches or head office, or other channel prescribed by us in the future.

You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA.