Privacy & Legal Information

In compliance with the Personal Data Protection Act B.E. 2562 (2019) and other applicable laws, including any future amendments thereto (collectively, the “Personal Data Protection Laws”), K Sera Company Limited (the “Company”) has prepared this Privacy Notice (the “Notice”) to explain in detail how the Company collects, uses, and discloses your personal data. This Notice applies to you as a Customer of the Company, as well as to persons associated with the Company's Customers, including directors, shareholders, employees, agents, or any other persons acting on behalf of, or in the name of, the Company's Customers.

Definitions

Term	Definition
“Personal Data”	Means information relating to a natural person which enables the identification of that person, whether directly or indirectly, but excluding the information of deceased persons specifically.
“Sensitive Personal Data”	Means personal data concerning race, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal record, health data, disability, trade union data, genetic data, biometric data, or any other data which may affect the data subject in the same manner, as prescribed by the Personal Data Protection Laws.
“Legal Basis”	Means the ground recognised by law that permits the collection of personal data, under the Personal Data Protection Laws.
“Customer”	Means a person who purchases or may purchase goods and/or use the services of the Company, or any other person of a similar nature, such as a person who contacts the Company to request information or services.
“Person Associated with the Customer”	Means a natural person who is associated with, or who acts as a representative of, a Customer, such as an executive, director, shareholder, employee, agent, or any other natural person acting on behalf of, or in the name of, the Company's Customer.

Categories of Personal Data Collected by the Company

The Company collects your personal data, in whole or in part, as specified in this Notice, to the extent necessary to carry out the purposes of the Company set out in this Notice.

Category	Examples
Identification Data	Title, first name, surname, photograph, national ID card number, passport number, signature, etc.
Contact Data	Address, personal telephone number, personal email, Line ID, Facebook, and other contactable information, etc.
Employment Data	Job title, department, place of work, office email bearing your name, etc.
Document Data	Business card, copy of ID card, copy of passport, copy of taxpayer card, purchase order, quotation, certificate of incorporation, VAT registration certificate, and other documents, etc.
Other Data	Images from Company activities; still and moving images recorded by closed-circuit television (CCTV); the date and time of your contact with the Company; data showing your comments on or interest in products or services; purchasing behaviour; satisfaction with products or services, etc.
Sensitive Personal Data	Religion, as it appears on a copy of an ID card, etc.

Sources of Personal Data

The Company collects your personal data from the following direct and indirect sources:

Source	Channel
Directly from you	Through any of the following channels: Verbally — for example, in-person conversations or telephone calls. Through documents — for example, business cards, contract documents, agreement documents, company certification letters, quotations, purchase orders, forms, or other documents. Through other contact channels — for example, email or online networks.
From other sources or third parties	From other sources or third parties, such as a juristic person or natural person who is your employer or principal, a product distributor/service provider or business partner of the Company, a website providing business information, a search tool used for business contact purposes, a bank, or a government agency, etc. From channels through which you communicate with, make enquiries of, or provide comments or feedback to the Company, including from your expressed intention to purchase goods or use the Company's services, entering into a contract with the Company, or delivering documents, etc.

Purposes of Collecting Personal Data

The Company will collect your personal data for use and/or disclosure only for the purposes and on the legal bases set out in this Notice. If the Company needs to collect additional personal data, or to use personal data for a purpose other than those set out in this Notice, the Company will notify you of such collection and/or of the new purpose for the collection, and will seek your consent for the new collection, use, and disclosure of personal data where consent is required by law, in accordance with the requirements of the Personal Data Protection Laws.

Purpose of Collection	Legal Basis
1. Communication and other actions to negotiate prior to entering into a contract with you, or with the person or juristic person on whose behalf or in whose name you act, or whose employee you are — for example, arranging meetings, preparing quotations, and negotiating and agreeing on contract terms.	General Personal Data: Necessary for performance of a contract or to enter into a contract (where you are a direct party to the contract). Necessary for the legitimate interests of the Company and the Customer (where you act on behalf of, or in the name of, the Customer).
2. Entering into and performing a contract — for example, business communications, processing purchase orders for goods/services, providing services under a contract, delivery of goods, and following up on service outcomes, including disclosure of your data to relevant third parties such as delivery service providers, contractors, external service providers or specialists engaged to perform the contract or resolve issues relating to goods and services, including issues relating to the production process. The purpose of collection and disclosure will depend on the type of goods and services the Customer receives from the Company. Entering into and performing a contract under this item also includes contacting and coordinating with you on other contract-related matters, such as requesting changes to contract terms and other details, and contract renewal.	General Personal Data: Necessary for performance of a contract (where you are a direct party to the contract). Necessary for the legitimate interests of the Company and the Customer (where you act on behalf of, or in the name of, a business partner). Sensitive Personal Data: Explicit consent.
3. Customer relationship management activities — for example, handling complaints, evaluations, and enquiries about opinions on products, in order to improve and review the Company's service quality.	General Personal Data: Necessary for the legitimate interests of the Company.
4. Billing for goods or services, issuing receipts, and any action to collect outstanding debts where the Company's Customer defaults on payment for goods and services.	General Personal Data: Necessary for performance of a contract (where you are a direct party to the contract). Necessary for the legitimate interests of the Company and the Customer (where you act on behalf of, or in the name of, the Customer). Sensitive Personal Data: Explicit consent.
5. Management of the Company's organisation and business operations — for example, systems and database management, applications for business licences with government agencies, auditing, internal review, seeking advice from business consultants, disclosure of your data to financial institutions in connection with the Company's credit applications, business acquisitions or disposals, mergers, and organisational restructuring.	General Personal Data: Necessary for the legitimate interests of the Company. Necessary for compliance with a legal obligation applicable to the Company.
6. Compliance with legal obligations applicable to the Company — for example, issuing tax invoices, and maintaining and disclosing accounting data to auditors and government agencies in accordance with the law and the orders of authorised officials.	General Personal Data: Necessary for the legitimate interests of the Company. Necessary for compliance with a legal obligation applicable to the Company.
7. Retaining your contact data in the Company's database for future business contact, including disclosing your data to affiliated companies for the purpose of contact and relationship-building to create future business opportunities.	General Personal Data: Necessary for the legitimate interests of the Company.
8. Security within the Company's premises — for example, monitoring the Company's premises by closed-circuit television (CCTV).	General Personal Data: Necessary for the legitimate interests of the Company.
9. Analysing purchasing behaviour for goods or services and conducting satisfaction surveys in order to design promotional activities or improve services.	General Personal Data: Consent Sensitive Personal Data: Explicit consent.
10. Protecting the Company's legitimate rights or defending against claims made against the Company — for example, legal proceedings, initiating a case, defending a case, out-of-court dispute resolution, and other actions to protect the Company's legitimate rights or defend against claims made against the Company as permitted by law.	General Personal Data: Necessary for the legitimate interests of the Company. Sensitive Personal Data: Necessary for the establishment, compliance, exercise, or defence of a legal claim.

Consequences of Not Providing Personal Data

The Company collects your personal data in order to communicate with you for the purpose of entering into a contract or carrying out actions in accordance with a contract with you, or with the person or juristic person on whose behalf or in whose name you act, or whose employee you are, and in order to comply with applicable legal requirements. If you do not provide your personal data to the Company, you, or the person or juristic person on whose behalf or in whose name you act, or whose employee you are, may experience inconvenience in communicating for the purpose of entering into or performing a contract. In some cases, this may result in the Company being unable to enter into or perform a contract with you, or with the person or juristic person on whose behalf or in whose name you act, or whose employee you are. It may also, in some cases, place you, or such person or juristic person, in a position where applicable legal requirements cannot be complied with.

Disclosure of Personal Data, and Domestic and Cross-Border Transfer of Personal Data

In order to achieve the purposes of collecting personal data set out in this Notice, the Company may, in certain cases, need to disclose your personal data to persons or organisations, including but not limited to the following:

Persons or departments within the Company, including executives, supervisors, staff, employees, and/or other personnel of the Company, to the extent relevant and necessary for processing your personal data.
Service providers and agents engaged by the Company, such as auditors, legal advisors, business consultants, or other external specialist advisors, delivery service providers, and subcontractors, etc.
Other companies within the Company's group, business partners, and external service providers and agents engaged by such companies.
Government agencies, such as the Revenue Department, the Board of Investment, etc.
Commercial banks and the Bank of Thailand.
Police officers, courts, arbitrators, lawyers, and any other persons or agencies involved in litigation and dispute resolution proceedings.
Persons involved in business acquisitions or disposals, mergers, or organisational restructuring.

In certain cases, the Company may need to send or transfer your personal data to an affiliated company overseas for the purposes described above. The Company will ensure that the destination country has adequate personal data protection measures in compliance with the applicable laws in force at that time. Where the Company is required to send or transfer personal data to a country whose personal data protection standards have not been certified under law, or where no law has yet established such standards, the Company will comply with the conditions prescribed by law to ensure that such transfer is lawful, which may include seeking your consent where necessary, or arranging appropriate measures to ensure you can continue to exercise your rights, together with providing effective legal remedies as required by law.

Personal Data Retention Period

The Company will retain your personal data for a period not exceeding 5 years from the date on which the legal relationship between you, or the person on whose behalf you act, and the Company ends. Where the Company collects your personal data without entering into a legal relationship with you or the person on whose behalf you act, the Company will retain your personal data for a period not exceeding 2 years.

Notwithstanding the above, all or part of such personal data may be retained beyond the periods specified above where necessary for compliance with applicable law, or for the protection of the Company's legitimate rights, or for defending against claims made against the Company. In such cases, the personal data will be retained for as long as necessary to fulfil such purposes and/or within the period prescribed by law.

Your Rights Regarding Personal Data

You have the following legal rights in respect of the personal data that the Company has collected about you:

Right to withdraw consent: You have the right to withdraw your consent to the collection, use, or disclosure of personal data that you have consented to, in whole or in part, at any time during the period the Company retains such personal data. Withdrawal of consent will not affect the validity of the collection, use, or disclosure of personal data carried out prior to such withdrawal.
Right to access and request a copy of personal data: You have the right to request access to your personal data and to request that the Company provide a copy of your personal data, including a right to request that the Company disclose to you how it obtained personal data that you did not consent to provide to the Company.
Right to request data portability: You have the right to request that the Company send or transfer your personal data to another person or to yourself, subject to the conditions prescribed by law.
Right to object to the collection, use, or disclosure of personal data: You have the right to object to the Company's collection, use, or disclosure of your personal data, subject to the conditions prescribed by law.
Right to request erasure of personal data: You have the right to request that the Company erase, destroy, or anonymise your personal data such that it can no longer identify you, subject to the conditions prescribed by law.
Right to request restriction of use of personal data: You have the right to request that the Company restrict the use of your personal data, subject to the conditions prescribed by law.
Right to request rectification of personal data: You have the right to request that the Company correct inaccurate personal data or complete incomplete personal data.
Right to lodge a complaint: You have the right to lodge a complaint with the Personal Data Protection Committee if the Company, or its employees or contractors, violate or fail to comply with the Personal Data Protection Laws.

You may notify the Company of your exercise of the above rights in writing, using the Company's contact details set out below. Where the Company is unable to comply with your request, the Company will explain the reasons for such refusal together with its response.

Changes to this Privacy Notice

The Company reserves the right to amend and update this Privacy Notice as it deems appropriate. This Notice was last revised on 1 July 2022.

Contact Us

You may study the full details of this Privacy Policy at https://www.jorakay.co.th, or for further enquiries, please contact:
Email : PDPA@jorakay.co.th
K Sera Company Limited
No. 10 Krungthep Kreetha Road, Thap Chang Sub-district, Saphan Sung District, Bangkok 10250
Telephone : 02-720-1112