Customer Personal Data Protection Notice

STA Accounting and Consulting Co., Ltd. as a provider of consulting services, accounting and tax preparation and audit services, and other related supporting services, gives you as our client our assurance that the company attaches importance to and respects the rights of clients in relation to the personal data the company necessarily processes. The company has therefore prepared and issued this personal data protection notice so that you, as a client of the company (the Client), understand the necessity for, and the conditions attaching to, the collection, use and disclosure of the Client's personal data that the company must carry out in order to provide its services or to discharge fully the obligations and duties it may owe to the Client.

 

Clause 1. Acceptance of this personal data protection notice 

When a Client contacts the company, and when a Client agrees to enter into a service contract with the company, the company will treat the Client as having accepted and acknowledged all of the personal data processing conditions set out in this notice. The company may revise this notice from time to time to keep it consistent with the law, with relevant regulations, and with the services the company provides to Clients. The company will inform Clients of any change by publishing the revised notice through its various contact channels, and a Client who continues to use the company's services after such a revision will always be treated by the company as having agreed to and accepted the revised notice.

 

Clause 2. Definition and scope of the personal data to be processed

Personal data means information relating to a person which enables that person to be identified, whether directly or indirectly, under the Personal Data Protection Act B.E. 2562 (2019) as amended from time to time and other related law.

 

For the avoidance of doubt, personal data under this notice includes the personal data of the authorised representatives of a Client that is a juristic person, and the personal data of persons within that juristic person Client, which may be passed on and disclosed to the company for the provision of services (Representatives). Where a Client provides the company with the data of its Representatives, the company will treat the Client providing that data as having given its assurance as to the accuracy of the data and as to the Client's right to disclose that Representative's personal data to the company for processing under the conditions set out in this notice.

 

The personal data the company collects about you

1. Personal details, such as name and surname, title, gender, date of birth, national identification number, passport number, taxpayer identification number, position, nationality, age, work experience or employment history, areas of expertise and aptitudes, together with sensitive data comprising religion, race and health information, for which the company has obtained your lawful consent or for which there is a necessity permitted by law.

2. Contact details, such as address, telephone number, mobile telephone number and email address.

3. Financial and business information, such as bank account numbers, transaction data, and price and product details.

4. Other personal information, such as data on use of the company's information systems and websites, CCTV recordings, and audio recordings of meetings.

 

Clause 3. Sources of the personal data the company processes

The company may receive a Client's personal data from the following sources: 1) directly from the Client who contacts or sends it to the company, through each contact channel, contract, or transaction document; 2) personal data the company may obtain from public sources, such as government agencies, state enterprises and the internet.

 

Clause 4. Purposes of collecting, using and disclosing personal data

            The company collects, uses or discloses a Client's personal data for purposes resting on the following lawful bases for processing.

            4.1 Contractual basis. To perform a contract to which the Client is a party, such as a service agreement, a licence agreement or any other contract, or to act on the Client's request or application before entering into a contract, as the case may be.

            4.2 Legal obligation. To discharge duties prescribed by law, such as labour protection law, social security law, workmen's compensation law, labour relations law, provident fund law, tax law, anti-money laundering law and computer law.

            4.3 Legitimate interest. For the lawful legitimate interests of the company, not exceeding what the Client can reasonably expect, and without infringing the Client's fundamental rights or freedoms.

            4.4 Consent. The company will request the Client's consent where the law requires consent, or where the company has no ground to rely on any of the bases above to process personal data collected from the Client.

 

Clause 5. Purposes of collecting, using or disclosing personal data under each lawful basis

The company collects, uses or discloses your personal data for a number of purposes under the following lawful bases.

Purpose

Details

5.1 To act on the Client's request before entering into a contract, or to perform a contract

To verify or identify the Client when using the company's platform, to provide services to the Client, or to perform any contract to which the Client is a party. This includes managing the Client's account, membership application details, delivery, accounting and financial processing, after-sales service, and anything else needed for the Client to receive the service or as the Client has requested.

5.2 To manage advertising and public relations

Advertising and public relations, running marketing campaigns, analysis, product development, and contacting Clients to give advice or present products, including managing advertising and public relations media in which the Client appears as a presenter or as any part of the company's advertising and public relations material.

5.3 To manage operations and after-service client care

To review and analyse personal data and sensitive personal data

 

in order to develop the company's online service channels, so that Clients receive the company's services to the highest quality, as quickly and conveniently as possible.

5.4 To manage information technology

To build information systems for storing data, processing data, and connecting data with Clients and Representatives

 

To build and operate information technology systems for processing Client data arising from use of the company's websites, applications and social media, such as Facebook, LinkedIn, Twitter, YouTube and Line.

5.5 To manage, develop and take any action enabling the business to operate more effectively

Managing services (including the website and applications), detecting and preventing fraud or other crime, managing relationships with clients and prospective clients, and maintaining and operating IT systems

 

Measuring the effectiveness of the company's marketing policy and the effectiveness of the company's advertising across its various channels

5.6 To manage complaints, disputes and legal proceedings, and to manage risk

Auditing and investigating dishonest conduct, fraud, or acts contrary to law or public order

 

Any action to examine, investigate, inquire into, litigate or take any measure to exercise contractual and legal rights, and to settle disputes or conflicts that may arise between the company and a Client in connection with the company's services

 

Clause 6. Disclosure of the Client's personal data

In order to carry out the purposes set out in this privacy notice, a Client's personal data may be disclosed or transmitted to units within the company and to external persons or bodies, as follows.

6.1 Within the company. A Client's personal data may be disclosed or transmitted to units within the company only where they are relevant and have a role and duty, and only to the extent necessary for the purpose. Those individuals or teams within the company are permitted to access the Client's personal data as necessary and appropriate.

• Client relations staff, or staff of other units only where relevant, with access rights set according to the role and responsibilities held

• Executives, or direct supervisors within the company, who are responsible for managing or deciding on company matters, or where personnel processes are involved

• Supporting departments or teams, such as information technology, administration, accounting, procurement and finance

6.2 Outside the company. The company may disclose a Client's personal data to external organisations for the purpose of providing services or supplying products in line with the Client's requirements, namely:

• the Department of Business Development

• the Revenue Department

• the Social Security Office

• the audit firm

• affiliated companies, such as Auditor Team Co., Ltd. and STA Insurance Broker Co., Ltd.

Clause 7. Marketing and privileges

            The company may use a Client's personal data beyond the purposes notified to the Client through this privacy notice, and within the requirements of the law, by using the Client's name, surname and contact details, such as email address, telephone number including mobile number, and postcode, in order to:

            7.1 send messages informing the Client of benefits relating to the company's products and services, including cross-selling and/or upselling offers of products or services;

            7.2 operate a loyalty programme or a client privilege programme;

            7.3 run sales promotion activities and marketing communications, including contests, prize draws, lucky draws, events and competitions that the Client is interested in taking part in;

            7.4 make donations to charitable activities and/or other non-profit purposes.

 

            In carrying out the above, the company may need to disclose the Client's personal data to its personnel and/or business partners in order to achieve those purposes.

 

Clause 8. Requesting consent and the possible effects of withdrawing consent

            8.1 Where the company collects, uses or discloses personal data on the basis of the Client's consent, the Client has the right to withdraw that consent given to the company at any time. Withdrawing consent does not affect the collection, use or disclosure of personal data to which the Client has already consented.

            8.2 If the Client is a minor under the Civil and Commercial Code, please provide the company with the details of the person exercising parental power before giving consent, so that the company can also obtain that person's consent.

            A Client may withdraw consent to the collection, use or disclosure of all or part of the Client's personal data, as set out in this privacy notice, by notifying the company.

 

Clause 9. Disclosure of your personal data

The company will not disclose your personal data to any third party, except where you have been duly notified and/or your consent has been obtained, or where the company is required by law to disclose or report your personal data to regulators, government agencies and other bodies as prescribed by the law applicable to the company's business.

In addition, the company may need to disclose your personal data to relevant third parties for the purposes set out above, in connection with audit work, obtaining legal advice, examination, assessment, legal proceedings and anything else necessary to the conduct of the business.

 

Clause 10. Governing law

            The Client acknowledges and agrees that this privacy notice is governed by and construed in accordance with Thai law, and that the Thai courts have jurisdiction over any dispute that may arise.