Personal Data Protection Policy
of Baan SIRISA Co., Ltd. (Head Office) or its affiliates (as applicable)
Baan SIRISA Co., Ltd. (Head Office) ("the Company") or its affiliates (as applicable) understands and recognizes that the personal data of data subjects is important and deserves legal protection. Therefore, when the Company uses your personal data in its business operations or services, your personal data will be protected in accordance with the Personal Data Protection Act.
As a personal data controller, the Company has a legal duty to notify you of this privacy policy, which explains the collection, use, or disclosure of your personal data and your rights as a data subject. The Company confirms that it complies with this law to protect your personal data.
This Personal Data Protection Policy has been prepared to inform you of the Company's privacy practices, including the collection, use, or disclosure of your personal data and your rights as a data subject. The Company confirms that it will comply with this policy and applicable laws to protect your personal data.
1. Definitions
"Public Data" means personal data that the data subject has clearly and voluntarily disclosed to the public, such as social media profile information when using social media credentials (such as Facebook, Instagram, Twitter, and Line) and other online platforms to connect to or access any Company services. Examples include social media account IDs, interests, likes, and friend lists. Data subjects can control the privacy settings for this information through the account settings provided by each social media service provider.
"Personal Data (General)" means information relating to an individual that can directly or indirectly identify that individual, excluding information relating to deceased persons.
"Sensitive Personal Data" means personal data relating to race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union membership, genetic data, biometric data, or any other data that affects individuals in the same manner as announced by the relevant committee.
"Cookies" means data that a website receives from or sends to the computer or device used by a website visitor while browsing that website.
"Personal Data Protection Committee" means the committee responsible for personal data protection as prescribed under the Personal Data Protection Act.
"Office of the Personal Data Protection Committee" means the office responsible for supervising personal data protection under the Personal Data Protection Act.
"Usage Logs" means data generated from the use of applications, web services, or other platforms, including source, origin, destination, route, time, date, volume, duration, service type, or any other information relating to the use of applications, web services, or other platforms.
2. Collection of Personal Data
The Company collects your personal data directly and indirectly through offline and online channels from various sources. The collection, use, or disclosure of your personal data will be limited to what is necessary to achieve the purposes specified in this Personal Data Protection Policy, or as necessary to provide services and facilitate your use of the Company's services. Your data may be categorized as follows:
a) Contact Data: such as full name, gender, date of birth, age, address, email address, telephone number, nationality, marital status, family size, income, expenses, workplace, product and service preferences, hobbies, regular social network activities, sports interests, travel preferences, preferred channels for receiving news or information, real estate purchase budget, reasons for selecting or not selecting products and services, product or service viewing history, and feedback on products and services.
b) Technical Data: such as computer IP address, cookie data, browser type, time zone settings, location, operating system, platform, and device technology used to access the website.
c) Usage Data: such as browsing behavior, pages visited before entering the platform, visited pages, time spent on the home page, products or information searched for on the platform, website visit times and dates, clickstream data, and other website interaction data.
d) Communication Data: such as information stored in emails, conversation records, and information from various communication channels.
e) Transaction Data: such as national identification number, address, credit card number, date of birth, gender, bank account number, and other related information.
f) Event Participation Data: such as photographs, conversations, and interview records from participation in Company activities.
3. Sources of Personal Data
3.1 The Company receives personal data directly from you through various channels, such as when you register by creating an account on the website or other platforms; when you contact the Company to request information about products or services that interest you; when you make an appointment to visit a residential project; when you provide information during a project visit; when you participate in the Company's promotional activities through electronic channels, social networks, or regular channels; and when the Company contacts you to offer products or services.
3.2 The Company may receive your personal data from third parties that collect, use, or disclose personal data under the Company's instructions or on the Company's behalf, or with your consent (as applicable). Your personal data will not be used for purposes other than those specified by the Company or to which you have consented (as applicable). The Company ensures that such third parties must keep your personal data confidential and protect it in accordance with the standards of Thailand's personal data protection law.
3.3 Personal data obtained from cookies or visit logs when you visit the Company's website or application helps the Company improve the quality, speed, security, and privacy of services when you use and/or access the platform.
3.4 The Company does not intend to collect personal data from persons under the age prescribed by law ("Age Threshold"). If you are under the Age Threshold, please refrain from using the Company's services and do not provide any personal data to the Company. If you are a parent or legal guardian of a child under the Age Threshold and become aware that your child has provided personal data to the Company, please contact the Company and exercise your rights. If you are under the Age Threshold and wish to use the Company's services, please ensure that your parent or legal guardian has consented to the collection of your personal data.
4. Purposes for Collecting Personal Data
The Company collects, uses, or discloses your personal data within the scope of personal data protection law and only as necessary for the following purposes:
- To perform a contract to which you are a party, or to take steps before entering into a contract at your request ("Contractual or Pre-Contractual Performance").
- For legitimate interests of the Company or third parties ("Legitimate Interests").
- To comply with the Company's legal obligations ("Legal Compliance").
- To carry out purposes for which you have given consent ("Consent").
- For purposes requiring consent, especially data that requires consent, such as information related to activity participation for public relations, marketing, or promotional purposes, including the collection of photographs or interviews.
- For other necessary purposes permitted by law, such as public interest, education, research, statistics, protection or prevention of threats to life, health, or well-being, or the performance of duties necessary for the Company's public interest functions or duties assigned by the state (if any).
The Company summarizes the collection, use, or disclosure of your personal data for service provision or delivery of product and service information to you, and explains the legal bases used by the Company to process your personal data for each activity in the following table:
Purpose |
Data Type |
Legal Basis for Processing |
|---|---|---|
| 1) To provide services to you and provide information about products or services that interest you, including developing products and services to meet your needs. |
|
|
| 2) To manage relationships, provide privileges, or organize activities with you as a customer, a person interested in products or services, or a related person. |
|
|
| 3) To manage the Company's websites, applications, and other platforms, resolve technical issues arising from their use, and improve and develop services. |
|
|
| 4) To analyze data for website development and improve the customer experience in receiving the Company's services. |
|
Legitimate interests |
| 5) For purposes related to contracts for purchase, sale, lease, consignment, real estate leasing, service provision, or other activities. |
|
Contractual performance or request |
| 6) To contact and send information to banks to facilitate loan application processing. |
|
Contractual performance or request |
| 7) For direct marketing to offer products or services that may interest you, including analysis, marketing planning, and marketing activities, only with your consent. |
|
Consent-based processing. The Company will request your consent to use your personal data for direct marketing to offer products or services that may interest you. |
| 8) To provide property and common area management services and facilitate your residence or business operations within projects after you purchase or lease those projects from the Company, including sharing data with property management agents or through other service channels relating to residence for the benefit of residents or tenants. |
|
Contractual performance or request |
The Company may rely on more than one legal basis to process your personal data, depending on the specific purpose of each activity involving your personal data. The Company may also rely on other legal bases as necessary and permitted by law.
If you are required to provide personal data to comply with law, a contract, or pre-contractual requirements, failure to provide such data or providing incomplete data may affect the Company's ability to provide services or comply with legal and contractual obligations, and may prevent you from purchasing or leasing products or receiving services from the Company.
For the collection, use, or disclosure of sensitive personal data that requires your explicit and direct consent, the Company clarifies that you are not required to give such consent. The Company will not refuse to provide services because you refuse to consent. However, not providing such data may affect the development of products and services that match your needs and may affect the sending of marketing promotions or offers to you.
In addition, certain sensitive personal data may be collected without your consent, particularly when it involves data made public, or when necessary for legal claims, legal compliance, exercise of legal rights, or other applicable laws.
5. Data Storage and Retention Period
The Company stores your personal data in the Company's information systems and ensures that standard security measures are applied to those systems and to the use of your personal data. These measures include:
- Restricting access to personal data by employees, agents, partners, or third parties. Third-party access to personal data is permitted only as specified or instructed, and such third parties are responsible for maintaining confidentiality and protecting personal data.
- Using technological methods to prevent unauthorized access to computer systems.
- Managing the secure destruction of your personal data when it is no longer necessary for legal or business purposes.
- Having procedures to manage personal data breaches or suspected breaches, and reporting such breaches to the Office of the Personal Data Protection Committee as required by law.
- Data retention period.
- The Company will retain your personal data for as long as necessary for service provision, analysis, marketing strategy planning, and marketing activities. This retention period follows industry standards, accounting standards, legal standards, limitation periods, and other relevant regulations.
- Personal data obtained from cookies and website usage logs will be retained for up to 60 months or as otherwise required by applicable laws and regulations.
6. Categories of Persons or Organizations to Whom Personal Data May Be Disclosed
- Affiliates, companies within the Company's group, business partners, or relevant employees of the Company.
- Individuals and juristic persons authorized to act as the Company's representatives in providing services within the Company's projects, including their employees and agents.
- Online advertising platforms.
- Marketing, sales, or business consulting companies or advisors.
- Contractors or business partners.
- Banks, financial institutions, or lenders.
- Real estate agents.
- Companies or advisors in finance, accounting, legal, or other professional fields.
- Condominium juristic persons or residential development project juristic persons, and/or condominium managers or residential project managers.
The Company requires third parties to whom it discloses or shares your personal data as described above to keep your personal data confidential and protect it in accordance with the standards prescribed by Thailand's personal data protection law. Such third parties may use your personal data only as required by law, for the purposes specified by the Company, or as instructed by the Company.
The Company may disclose your personal data to relevant authorities or regulators to comply with the law.
7. Rights of Personal Data Subjects
As a personal data subject, you have the following rights to the extent permitted by law:
- 1. You have the right to withdraw consent previously given to the Company for the collection, use, or disclosure of your personal data at any time while your personal data remains with the Company. Withdrawal of consent will not affect any collection, use, or disclosure of personal data for which you previously gave consent. However, withdrawing consent may cause services, product recommendations, or other recommendations to no longer match your needs and may affect your right to participate in promotions ("Right to Withdraw Consent").
- 2. You have the right to access your personal data and request that the Company provide a copy of such personal data, including requesting disclosure of how the Company obtained your personal data without your consent ("Right of Access").
- 3. You have the right to request that the Company correct your personal data so that it is accurate, current, complete, and not misleading ("Right to Rectification").
- 4. You have the right to request that the Company delete, destroy, or anonymize your personal data ("Right to Erasure").
- 5. You have the right to request that the Company suspend the use of your personal data for certain reasons ("Right to Restriction of Processing").
- 6. You have the right to obtain your personal data from the Company where the Company has arranged such personal data in a readable or commonly usable format by automatic tools or equipment and where you can use or disclose such personal data by automated means. You may also request that such personal data be transferred in the same format to another controller where this can be done automatically, or request to receive personal data that the Company has sent or transferred in the same format directly to another controller ("Right to Data Portability").
- 7. You have the right to object to the collection, use, or disclosure of your personal data for certain reasons ("Right to Object to Processing").
- 8. You have the right to lodge a complaint with the Office of the Personal Data Protection Committee if the Company, as a data controller or processor (as applicable), or its employees or contractors do not comply with the Personal Data Protection Act. You may exercise these rights by contacting the Company using the contact details in section 12 of this notice. The Company will consider and respond to your request without undue delay or within the period prescribed by law. Please note that exercising your rights may be subject to limitations under applicable law, and there may be cases where the Company refuses or is unable to comply with your request. The Company reserves the right to refuse or be unable to comply with any request where permitted by law.
8. Cookie Policy
The Company uses cookies to store information about your website visits in order to help improve quality, speed, security, and privacy when you use our services. When you use the Company's services through the website, the Company uses cookies for the following purposes:
Functional Cookies: The Company uses these cookies to help remember your device or browser, allowing the Company to tailor content to your personal interests more quickly. This improves the convenience and usefulness of services and platforms for you. If you wish to disable these cookies, you can adjust your device or browser settings using the help function of your browser or device.
Analytical Cookies: The Company uses analytical cookies provided by Facebook, Google, and other service providers to analyze how visitors use the website. This analysis is used to present products or services to you through social media advertising. If you do not consent to these third parties processing your personal data, you can configure your device settings by referring to the help features of your browser or device.
9. Personal Data Security
9.1 The Company has implemented appropriate security measures to protect personal data in accordance with data protection standards and to prevent loss, unauthorized access, destruction, use, alteration, modification, or unauthorized or unlawful disclosure of personal data. These measures comply with the Company's information security standards.
In addition, the Company continuously improves and tests its information security systems to ensure the highest level of security and reliability for your personal data. The Company reserves the right to modify security systems or tools if it considers that such changes will enhance data security and maintain a high level of protection. The Company will continuously update and test security measures to ensure ongoing data security.
9.2 The Company has procedures for handling personal data breaches.
9.3 If the Company engages external parties to process personal data or to develop and maintain systems, such external parties will use your personal data only as specified or instructed, and they must also maintain confidentiality and protect your personal data.
10. Links to External Websites or Applications
This personal data policy applies only to services provided by the Company and to use of the Company's websites or applications. If you click a link to another website or application, even if accessed through the Company's website or application, you must review and comply with the personal data policy displayed on that website or application, which is separate from the Company. Those websites or applications may have personal data policies that differ from the Company's policy. The Company is not responsible for the content, policies, damages, or any actions arising from third-party websites or applications.
11. Personal Data Collected Before the Personal Data Protection Act B.E. 2562 Came into Force
If the Company collected your sensitive personal data before the Personal Data Protection Act B.E. 2562 (2019) came into force and such data is subject to that Act, the Company will continue to collect and use your personal data for the original purposes. You have the right to withdraw consent by contacting the Company as specified in section 12 of this notice.
12. Contact Channels
If you have any questions or wish to contact us to exercise any rights as a data subject, or if you have any complaints, you may contact us through the following channels:
Baan SIRISA Co., Ltd. (Head Office)
Contact address: 39/38 Moo 2, Khao Mai Kaew Subdistrict, Bang Lamung District, Chonburi 20150
Contact channel: contact the Company through the website www.sirisa.com or by telephone at 064 454 6662
13. Reservation of Rights
Although this Personal Data Policy refers to Baan SIRISA Co., Ltd. (Head Office) or its affiliates, it is intended to serve only as a general policy of Baan SIRISA Co., Ltd. (Head Office) or its affiliates. This policy does not bind those companies unless specifically agreed by the company requesting consent, entering into a contract, or receiving your request to collect your personal data for the purpose of processing your request before entering into a contract and acting on that request. This may include companies that are controllers of your personal data under law and are related to the purposes of this policy. It does not apply to other unrelated companies, even if they are affiliates. You agree not to claim damages from such unrelated companies.
14. Request to Delete Personal Data (Facebook Data Deletion Instructions)
If you wish to delete data received through the Facebook Login system on this website, you can send an email notifying your intention to request deletion of your data at: marketing@sirisa.com We will process the deletion of your data from our database within 24-48 hours.
15. Changes to the Personal Data Protection Policy
The Company reserves the right to update, amend, or change this Personal Data Protection Policy, in whole or in part, in the future as it deems appropriate and in accordance with the law. If any update, amendment, or change is made, the Company will notify you through appropriate channels.
This notice will take effect from July 1, 2026 and will remain in effect until it is updated, amended, changed, or revoked.
