Privacy Policy of Foreigner Friendly (Thailand)

This Privacy Policy describes the information that we gather and how we use and process the information. For each processing purpose we will explain the reason for requiring the data, what data we will process, the legal basis for processing the data and how long we will keep the data. Where the legal basis of consent is to be used, this will be gathered freely, and we will use clear, plain language that is easy to understand, and you will be able to remove your consent at any point.

What information do we collect about you?

We collect/process information so that we can provide our services. This section of the policy will describe the purpose for processing your personal data, the legal basis to do so and how long we will keep your data.

Our Product / Service

If you choose to use our service, you must provide us with some personal data so that we can provide our services to you. This will include your name, email address, phone number, age and nationality, and payment details (for paid customers).For Businesses you will be required to provide such information as to advertise your product or service, in addition to this you will be required to provide details of your company contact details including telephone number, email address and website address and social media details.

You will also be required to provide payment details.

Personal data will be retained for a period of up to 2 years for an account that has not been renewed.

Children

If you are under the age of 20 in Thailand and have legal restrictions we are required to have the consent of your parents or legal guardian to disclose or collect your personal data this age restriction will vary from country to country with applicable laws. If we notice that we have collected personal information without parental consent we will take steps to remove such information.

Corporate

If you choose to use our services, personal data items such as Name, Email Address and Telephone number may be stored in our Corporate Cloud Storage, Corporate Email Platform, or our Help Desk platform. We will process data using the following legal rationale: we will ask for your consent. Personal data will be retained for a period of up to 3 years for an active account, when we will ask you to renew your data provided to us to continue using the service.

Marketing

We would like to send you information about products and services from our platform which may be of interest to you. By entering your details on our site and becoming a paid customer, you are agreeing to allow us to send you promotions and flash discounts from businesses on our platform. You have a right at any time to request us to stop contacting you for marketing purposes which will include the cancellation of your paid membership . The personal data used will include names, email addresses and telephone numbers and nationality.

We will process data using the following legal rationale to send marketing information: we will ask for your consent. This rationale for marketing information can be removed by informing us of your wish to remove consent.

We will retain personal data for active customer leads for a period of up to 2 years, a lead will be active under the following circumstances:

An email sent by our organization has not received an unknown account bounce back

An email has been sent to our organization from the data subject

Your full name(s) as printed on your passport or ID card.

Your Date of Birth. Citizenship.

Cookies

Like many websites, we use cookies and similar technologies to collect additional website usage data and to improve our Services. Website usage information is collected using cookies to monitor aggregate site usage metrics such as total number of visitors, pages viewed and web traffic routing on our Services. We will store the cookie values on our platform to allow us to perform our analysis, however this will not be used to target marketing material to an individual user.

We will process data under the legitimate interest legal basis as we only use the data to perform aggregated tracking analysis and will not target individuals based upon this analysis and you also need to accept our cookie policy to allow us to process the data.

We will retain active cookie data for a period of up to 1 year, a cookie will remain active if a user re-visits our platform.

Updating These Terms

We may change our Service and policies, and we may need to amend these Terms so that they accurately reflect our Service and policies. Unless otherwise required by law, we will notify you before we amend these Terms and give you an opportunity to review them before they go into effect. Then, if you continue to use the Service, you will be bound by the updated Terms. If you do not want to agree to these or any updated Terms, you can request an account deletion.

Your Rights

Accessing or rectifying your personal data: we want to make sure that your personal information is accurate and up to date and you have the right to request a copy and update the personal data that we hold about you. You may ask us to correct or remove information you think is inaccurate. If you would like to invoke this right, please email, or write to us at the below address.

Deletion

Based upon the retention periods described above we will remove your personal data from our platforms.

Object, Restrict or Withdraw Consent You may wish to object to or restrict our ability to process your personal data, this can be done either via email or in writing, using the contact details below. Further context may need to be requested to ensure we can conduct the relevant tasks on our platforms to perform the request.

Who we are and how to contact us.

We are the data controller responsible for defining and managing how your personal data is processed. Our company name is Foreigner Friendly Thailand.

To Whom We Disclose Information

Except as described in this Policy, we will not intentionally disclose the Personal Data or Client Data that we collect or store on the Service to third parties without the consent of the data subject. We may disclose information to third parties if you consent to us doing so, as well as in the following circumstances:

Unrestricted Information. Any information that you voluntarily choose to include in a Public Area of the Service, such as a public profile page, will be available to any Visitor or User who has access to that content.

Service Providers. We work with third party service providers who provide email hosting, core corporate applications, web hosting, maintenance, and other services for us. These third parties may have access to, or process Personal Data or Client Data as part of providing those services for us. We limit the information provided to these service providers to that which is reasonably necessary for them to perform their functions, and our contracts with them require them to maintain the confidentiality of such information. Service providers include:

Amazon Web Services Inc (AWS), 440 Terry Ave N, Seattle, WA 98109; for the purpose of Hosting and with our users through email and in the application

Google Analytics, 1600 Amphitheatre Parkway Mountain View, CA 94043 United States; for the purpose of data and analytics, including site usage, page visited and origin of users.

Overseas transfers

The information that you provide may be transferred outside of Thailand which is covered by the (PDPA)Personal Data Protection Act. The information may also be transferred to countries outside the European Economic Area (EEA) that do not have similar protections in place regarding your data and restrictions on its use as set out in this policy. However, we will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland, and Liechtenstein. By submitting your information, you consent to these transfers for the purposes specified above. We may transfer your personal information to the following which are located outside the European Economic Area (EEA) as follows:

Google Analytics, 1600 Amphitheatre Parkway Mountain View, CA 94043 United States; for the purpose of data and analytics, including site usage, page visited and origin of users.

AWS, Google Analytics, have each provided the following safeguards to ensure the safety of your personal data, and it shall be processed to at least the same standards as set out by the General Data Protection Regulations and Personal data Protection Act Thailand. AWS, Google Analytics, each participates in The Privacy Shield framework, which is accepted by the European Commission as evidence that an adequate level of protection exists for the personal data in the country, territory, or organization where it is being transferred, in this case, the United States.

You can obtain a copy of the safeguards and any other of Google Analytics’ data protection documentation by visiting https://analytics.google.com/, or applying via post to Google Analytics, 1600 Amphitheatre Parkway Mountain View, CA 94043 United States.

Non-Personally Identifiable Information

We may make non-personally identifiable information available to third parties for various purposes. This data may be automatically collected and would be analyzed to create an aggregated view of the data, ensuring the reported information was anonymous.

Law Enforcement, Legal Process and Compliance

We may disclose Personal Data or other information if required to do so by law or in if such action is necessary to comply with applicable laws, in response to a valid court order, judicial or other government request or warrant, or to otherwise cooperate with law enforcement or other governmental agencies.

Change of Ownership

Information about data subject, may be disclosed and otherwise transferred to an acquirer, successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets and only if the recipient of the personal data commits to a Privacy Policy that has terms substantially consistent with this Privacy Policy.‍

Our Data Security

We have appropriate security measures in place to prevent personal information from being accidentally lost, used, or accessed in an unauthorized way.

The following security procedures, and technical and organizational measures to safeguard your personal information have been put in place:

In cases where personal data is being processed in third countries or third parties, a rigorous data protection impact assessment is being performed to ensure that your data is always secured.

Our application platform is hosted in ISO 27017,27701, certified secure data centers . Firewalls, intrusion detection and prevention, anti-virus, anti-malware, backup, and disaster recovery are in place to prevent data loss or deletion.

The cloud security is ISO 27018.

Our applications are engineered by following industry standards to minimize security vulnerabilities and updates on a regular basis.

We use AWS managed services to ensure all our applications are always up to date and secure. This includes, but is not limited to, regularly applying critical and security patches to all services, firmware updates and securing physical hardware to minimize any risk.

Our employees undergo background screening and selection processes, with a restricted list of employees having access to secure areas of the applications, databases, and physical infrastructure. The access to the secure areas is logged and auditable.

We will use all reasonable efforts to safeguard your personal information. However, you should be aware that the use of the Internet is not entirely secure and for this reason we cannot guarantee the security or integrity of any personal information which is transferred from you or to you via the Internet.

We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. ‍

Data Breach Notification

If we become aware of a breach of your personal information and data we will notify the Office of the Personal Data Protection Committee as soon as is possible and within a target time of 72 hours after being made aware of the breach. If, however such data breach is likely to be of high risk we will also notify you directly of the personal data risk and the remedial actions we have taken via SMS, Email and Telephone and if possible Registered Mail.

Links to other sites

The Privacy Policy herewith is for our site and App and does not include any other site or App that is linked to our site or App please refer to their own Privacy Policy.

This privacy policy was last updated on 5/12/22

política de privacidad