4. Your rights
The PDPA aims to give you more control of your personal data. You can exercise your rights under the PDPA, details as specified below, through the channels prescribed by us:
4.1 Right to access and obtain copy
You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.
4.2 Right to rectification
You have the right to rectify your inaccurate personal data and to update your incomplete personal data.
4.3 Right to erasure
You have the right to request us to delete, destroy or anonymise your personal data, unless there are certain circumstances where we have the legal grounds to reject your request.
4.4 Right to restrict
You have the right to request us to restrict the use of your personal data under certain circumstances (e.g. when we are pending examination process in accordance with your request to rectify your personal data or to object the collection, use or disclosure of your personal data, or you request to restrict the use of personal data instead of the deletion or destruction of personal data which is no longer necessary but you ask us to restrict it instead as you have necessity to retain it for the purposes of establishment, compliance, exercise or defense of legal claims).
4.5 Right to object
You have the right to object the collection, use or disclosure of your personal data in case we proceed with legitimate interests basis or for the purpose of direct marketing, or for the purpose of scientific, historical or statistic research, unless we have legitimate grounds to reject your request (e.g. we have compelling legitimate ground to collect, use or disclose your personal data, or the collection, use or disclosure of your personal data is carried out for the establishment, compliance, or exercise legal claims, or for the reason of our public interests).
4.6 Right to data portability
You have the right to receive your personal data in case we can arrange such personal data to be in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means. Also, you have the right to request us to send or transfer your personal data to third party, or to receive your personal data which we sent or transferred to third party, unless it is impossible to do so because of the technical circumstances, or we are entitled to legally reject your request.
4.7 Right to withdraw consent
You have the right to withdraw your consent that has been given to us at any time pursuant to the methods and means prescribed by us, unless the nature of consent does not allow such withdrawal. The withdrawal of consent will not affect the lawfulness of the collection, use or disclosure of your personal data based on your consent before it was withdrawn.
You can review and change your consent to use or disclose your personal data for marketing purposes through channels as specified in No. 11 below or through Easy Invest Application / SCBS Easy Invest Application or other channel prescribed by us in the future
4.8 Right to lodge a complaint
You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA.
5. How we share your personal data
We may disclose your personal data to the following parties under the provisions of the PDPA:
a) companies in SCBX Group, business partners and/or other persons that we have the legal relationship, including our directors, executives, employees, staffs, contractors, representatives, advisors and/or such persons’ directors, executives, employees, staffs, contractors, representatives, advisors;
b) payment recipients, beneficiaries, account nominees, intermediaries (such as third-party securities companies, or asset management companies), registrars, underwriters, custodians, correspondents, co-brand business partners, market counterparties, issuers of products, or global trade repositories and/or other persons that we have the legal relationship, including our directors, executives, employees, staffs, contractors, representatives, advisors and/or such persons’ directors, executives, employees, staffs, contractors, representatives, advisors;
c) governmental authorities and/or supervisory or regulatory authorities (e.g. the Bank of Thailand, the Securities and Exchange Commission, Ministry of Digital Economy and Society, Anti-Money Laundering Office, Thai Revenue Department, the Stock Exchange of Thailand, Thailand Futures Exchange, Thailand Securities Depository, Thailand Clearing House, Department of Provincial Administration);
d) suppliers, agents, vendors and other entities ( e.g. professional associations to which we are member, external auditors, depositories, document warehouses, overseas financial institutions, and clearing houses) where the disclosure of your personal data has a specific purpose and under lawful basis, as well as appropriate security measures;
e) any relevant persons as a result of activities relating to selling rights of claims and/or assets, restructuring or acquisition of any of our entities, where we may transfer their rights to; any persons with whom we are required to share data for a proposed sale, reorganisation, transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets held by our business;
f) other banks, financial institutions and third parties where required by law to help recover funds that have entered your account due to misdirected payment(s) by such third parties or trace funds where you are a victim of suspected financial crime, or where suspect funds have entered your account as a result of financial crime;
g) debt collection agencies, lawyers, credit bureau, fraud prevention agencies, courts, authorities or any persons whom we are required or permitted by laws, regulations, or orders to share personal data;
h) third parties providing services to us (e.g. IT service providers, market analysis and benchmarking, including but not limited to correspondent banking, agents and subcontractors acting on our behalf, printing service providers);
i) social media service providers (in a secure format) or other third-party advertisers so they can display relevant messages to you and others on our behalf about our products and/or services. Third-party advertisers may also use information about your previous online activities to tailor adverts to you;
j) third-party security providers;
k) other persons that provide you with benefits or services associated with our products or services;
l) our corporate customers as you are director, authorised person, attorney, representative or contact person; and/or
m) your attorney, sub-attorney, authorized persons or legal representatives who have lawfully authorized power.
6. International transfer of personal data
The nature of the modern securities business is global and under certain circumstances it is necessary for us to send or transfer your personal data internationally (e.g. transferring data to companies in SCBX Group). When sending or transferring your personal data, we will always exercise our best effort to have your personal data transferred to our reliable business partners, service providers or other recipients by the safest method in order to maintain and protect the security of your personal data.
If the destination countries do not have adequate data protection standard, we will proceed to transfer personal data as specified by the PDPA and will put in place the protection measures of such personal data as necessary and appropriate.
7. Retention period of personal data
We will maintain and keep your personal data while you are our customer and once you have ended the relationship with us (e.g. after you closed your account with us, or following a transaction with us, or in case of your application to use our services is disapproved, or you terminated the services provided by us), we will only keep your personal data for a period of time that is appropriate and necessary for each type of personal data and for the purposes as specified by the PDPA.
The period we keep your personal data will be linked to the prescription period or the period under the relevant laws and regulations (e.g. Financial Institution Business Laws, Securities and Exchange Laws, Anti-Money Laundering Laws, Prevention and Suppression of Financial Support to Terrorism and the Proliferation of Weapons of Mass Destruction Laws, Accounting Law, Tax Laws, Labour Laws and other laws to which we are subject both in Thailand and in other countries). In addition, we may need to retain records of CCTV surveillance in our head office, our branches and/or voice records of Call Center to prevent fraud and to ensure security, including investigating suspicious transactions which you or related persons may inform us.
9. Use of personal data for original purposes
We are entitled to continue collecting and using your personal data which has previously been collected by us before the effectiveness of the PDPA in relation to the collection, use and disclosure of personal data, in accordance with the original purposes. If you do not wish us to continue collecting and using your personal data, you may notify us to withdraw your consent at any time.
We endeavour to ensure the security of your personal data through our internal security measures and strict policy enforcement. The measures extend from data encryption to access control restriction. We also require our staff and third-party contractors to follow our applicable privacy standards and policies and to exercise due care and measures when using, sending or transferring your personal data.
11. How to contact us
If you have any questions or would like more details about our privacy notice, please contact us through the following channels:
• Call Center Tel. (66) 2949-1999
• InnovestX Securities Company Limited
our head office located at SCB Park Plaza Building, Tower 3 East, 2nd, 20th-21st Floor, 19 Rutchadapisek Road, Chatuchak, Chatuchak, Bangkok 10900.
• our Data Protection Officer by writing to E-mail: email@example.com or our address as specified above.
If you would like to exercise your rights in accordance with PDPA, please contact us through our head office (to exercise all PDPA rights) and/or Easy Invest Application/ SCBS Easy Invest Application (only to give/withdraw your consent).
12. Changes to this privacy notice
We may change or update this privacy notice from time to time and we will inform the updated privacy notice at our website www.scbs.com
Version April 2022