Personal Data Protection Policy

of Areeya Property Public Company Limited or Its Affiliated Companies (as applicable)

Areeya Property Public Company Limited (“the Company”) or its affiliated companies (as applicable) understand and recognize that the personal data of data subjects are important and deserve protection under the law. Therefore, when the Company uses your personal data for its business operations or provides services, your personal data will be protected in accordance with the Personal Data Protection Act.

As a personal data controller, the Company is obligated by law to inform you of its privacy policy, which explains the collection, use, or disclosure of your personal data and your rights as the data subject. The Company affirms that it has acted in accordance with this law to protect your personal data.

This Personal Data Protection Policy is prepared to inform you about the privacy policy, which will explain the collection, use, or disclosure of your personal data and your rights as the data subject. The Company affirms that it will act in accordance with this policy, including the law, to protect your personal data.

1. Definition

“Public Information” means personal data that has been clearly and willingly disclosed to the public by the data subject, such as online social media profile data, when using online social media login credentials (e.g. Facebook, Instagram, Twitter, and Line), and other online platform formats to connect or access any of the Company’s services. Examples include online social media account IDs, interests, likes, and the data subject’s list of friends. The data subject can control the privacy settings for this data through the online social media account settings provided by the respective online social media service providers.

“Personal Data (General)” refers to data related to an individual that can identify that person directly or indirectly, excluding data on specific deceased persons.

“Sensitive Personal Data” refers to personal data concerning race, ethnic origin, political opinions, beliefs in religion or philosophy, sexual behavior, criminal record, health data, disabilities, labor union membership, genetic data, biometric data, or any other data that affects the individual in a similar manner as announced by the committee.

“Cookies” refer to data received or sent from a website to the computer or technology of the device used to access a website by the website visitor while they are browsing the site.

“The Personal Data Protection Committee” refers to the committee responsible for personal data protection as stipulated in the Personal Data Protection Act.

“The Office of the Personal Data Protection Committee” refers to the office responsible for overseeing personal data protection in accordance with the Personal Data Protection Act.

“Log” refers to information generated from the use of applications, web services, or other platforms. This includes the source, origin, destination, route, time, date, volume, duration, type of service, or any other information related to the usage of applications, web services, or other platforms.

2. Collection of Personal Data

The Company will collect your personal data directly and indirectly through offline and online channels through various sources of personal data. The collection, use, or disclosure of your personal data will be limited to what is necessary to fulfill the purposes outlined in this Personal Data Protection Policy, or as required for service provision and to facilitate your use of various services. Your data, which can be categorized into groups, includes:

a) Contact Information: Such as name-surname, gender, date of birth, age, address, email address, identification codes for contacting via various applications, phone numbers, nationality, marital status, family size, income, expenses, workplace, product and service preferences, hobbies, regular social network activities, sports interests, travel preferences, preferred channels for receiving news or information, budget range for purchasing a property, reasons for choosing or not choosing products and services, product or service viewing history, feedback on products and services, among others.

b) Technical Data: Such as computer IP addresses, cookie data, browser types, time zone settings, locations, operating systems, platforms, and device technologies used to access the website.

c) Usage Data: Such as data on app usage behavior, website browsing behavior, the pages visited before entering the platform, the pages visited, the time spent on the homepage, products or information searched on the platform, time and date of website visits, information on web page clicks, location data when using the application, and more.

d) Communication Data: Such as data stored in emails, conversation logs, and information from various communication channels.

e) Transactional Data: Such as national ID numbers, addresses, credit card numbers, dates of birth, gender, bank account numbers, and more.

f) Event Participation Data: Such as photos, conversation, and interview transcripts from your participation in Company events.

3. Personal Data Sources

3.1 The Company obtains personal data from you directly through various channels, such as:

  • When you register by creating an account on the website, application, or other platforms.
  • When you contact the company to request information about products or services you are interested in.
  • When you schedule appointments to visit residential projects.
  • When you provide information to the Company during visits to residential projects.
  • When you participate in Company sales promotion activities through electronic channels, social networks, or regular channels.
  • When the Company contacts you to offer products or services.

3.2 The Company may receive your personal data from external parties who collect, use, or disclose personal data by the order or on behalf of the Company, or with your consent (as applicable). Your personal data will not be used for purposes beyond those specified by the Company or to which you have consented (as applicable). The Company ensures that external parties are required to maintain confidentiality and protect your personal data in accordance with the standards of Thailand’s Personal Data Protection Law.

3.3 Personal data obtained from cookies or logs when you visit the Company’s website or applications helps the Company improve the quality, speed, security, and privacy of your services when you use and/or access the platforms.

3.4 The Company does not intend to collect personal data from individuals below the legally defined age limit (“Age Limit”). If you are below the Age Limit, please refrain from using the Company’s services and do not provide any personal information to the Company. If you are a parent or legal guardian of a child below the Age Limit and are aware that your child has provided personal information to the Company, please contact the Company and exercise your rights. If you are a child below the Age Limit and require the Company’s services, please ensure that your parent or legal guardian provides consent for the collection of your personal information.

4. Purposes of Collecting, Using, and Disclosing Personal Data 

The Company collects, uses, or discloses your personal data within the boundaries of personal data protection laws and as necessary for the following purposes: 

  • For necessary performance of contracts to which you are a party or pre-contractual actions at your request (“Contractual or Pre-Contractual Performance”).
  • For purposes that are in the legitimate interests of the Company or a third party (“Legitimate Interests”).
  • To comply with the Company’s legal obligations (“Legal Compliance”).
  • To carry out the purposes for which you have given your consent (“Consent”).
  • For other necessary purposes as granted by law, such as for the public interest or related to educational, research, or statistical purposes, for the protection or prevention of threats to life, physical health, or well-being, or to fulfill necessary duties in the public interest by the Company or duties granted by the state to you (if applicable), among others.

The Company has summarized the collection, use, or disclosure of your personal data for providing services or delivering product and service information to you. Additionally, it explains the lawful basis of processing that the Company uses for processing your personal data in each activity, as outlined in the following table: 

Objectives  Data Types  Lawful Basis of Processing 
1) To provide services to you and provide information about products or services you are interested in, including developing products and services to meet your needs.  – Contact Information
– Communication Data 		 1)  Performance of a contract or request
2) Legitimate interests
2) To manage relationships, grant special privileges, or organize activities with you as a customer or someone interested in using products or services, or associated individuals. – Contact Information
– Communication Data
– Data obtained from participating in activities 		 1) Performance of a contract or request
2) Legitimate interests 
3) For the purpose of consent, specifically for data that requires consent, such as information related to participating in activities for use in public relations, marketing, or sales promotion (including collecting photographs or interviews). 
3) To manage the Company’s website, applications, and other platforms, or to address technical issues that arise in the use of websites, applications, and other platforms, including to improve and develop services. – Contact Information
– Communication Data  		 1) Performance of a contract or request
2) Legitimate interests  
4) To analyze data for the development of the website and to enhance the customer experience in receiving services from the Company. – Technical Data
– Usage Data 		 Legitimate interests  
5) For the purpose of entering into contracts related to purchasing, selling, renting, consigning, renting real estate, providing services, or other activities. – Contact Information
– Data related to legal transactions 		 Performance of a contract or request 
6) Contacting and sending information to banks for the convenience of processing credit applications.  – Contact Information
– Data related to legal transactions 		 Performance of a contract or request 
7) For direct marketing to offer products or services that you may be interested in, including analysis, marketing planning, and marketing activities (only with your consent).  – Contact Information
– Usage Data 
– Communication Data  		 Consent-based processing, whereby the Company will request your consent to use your personal data for direct marketing to offer products or services that you may be interested in. 
8) To provide property and central management services, and to facilitate your residence or business operations within various projects after you have purchased or leased such projects from the Company. This includes sharing information with Areeya Management Company Limited or other property management agents to manage such administrative tasks, as well as through the Areeya Family Application or other applications and services related to residence and business operations within the project, and for the benefit of residents or tenants. – Contact Information
– Communication Data  
– Data related to legal transactions 		 Performance of a contract or request 

The Company may use more than one lawful basis for processing your personal data, depending on the specific purposes of each activity that involves your personal data. Additionally, the Company may use other necessary lawful bases as permitted by law. 

In cases where you are required to provide personal data to comply with the law, a contract, or if it is necessary for entering into such a contract, not providing or providing incomplete data may impact the Company’s ability to provide services or fulfill legal and contractual obligations. This may result in the inability to purchase or lease products or receive various services from the Company. 

For the collection, use, or disclosure of sensitive personal data that requires clear and explicit consent from you, such as sensitive personal data, the Company would like to clarify that you are not obliged to provide such consent. The Company will not deny you services due to your refusal to grant such consent. However, not providing such data may affect the development of products and services that align with your preferences and may impact the delivery of marketing promotions or offers to you. 

Furthermore, certain sensitive personal data may be collected without requiring your consent, especially when it involves collecting publicly available information or when it’s necessary for the establishment of legal claims, compliance with the law, the exercise of legal rights, or in accordance with other applicable laws. 

5. Data Retention and Retention Period 

The Company stores your personal data within its information systems and ensures standard security measures for the Company’s information systems and the use of your personal data. These measures include: 

  • Limiting access to personal data that may be accessed by employees, representatives, partners, or external individuals. Access to personal data by external individuals is granted as specified or directed, and these external individuals have responsibilities for safeguarding confidentiality and protecting personal data.
  • Implementing technological methods to prevent unauthorized access to computer systems.
  • Managing the destruction of your personal data for security reasons when the data is no longer necessary for legal or business purposes.
  • Having procedures in place to manage cases of personal data breaches or any suspicions thereof, and reporting such breaches to the Office of the Personal Data Protection Committee in compliance with legal requirements.

Data Retention Period 

  • The Company retains your personal data for the necessary duration to fulfill the purposes of providing services, analyzing and planning marketing strategies, and conducting the Company’s marketing activities. This retention period complies with industry standards, accounting standards, legal standards, statute of limitations, and any other relevant regulations. 
  • Personal data obtained from cookies and logs when you use the Company’s website will be retained for up to 60 months or as required by relevant laws and regulations. 

6. Types of Individuals or Organizations to Whom Personal Data May Be Disclosed: 

  • Subsidiaries, affiliated companies, group companies of the Company, partner companies, or related employees of the Company.
  • Individuals and entities authorized to act as representatives of the Company in providing services within the Company’s projects, including employees and agents of the aforementioned Company.
  • Online advertising platforms.
  • Companies or consultants in marketing, sales, or business consulting.
  • Contractors/ business partners.
  • Banks, financial institutions, or lenders.
  • Real estate agents.
  • Companies or consultants in finance, accounting, legal matters, or other professional fields.
  • Condominium juristic persons or housing development juristic persons and/or condominium administrators or housing development administrators.

The Company stipulates that external individuals to whom the Company discloses or shares your personal data, as mentioned above, must maintain confidentiality and protect your personal data in accordance with the standards set by Thailand’s personal data protection laws. They can use your personal data only as required by law, or according to the objectives that the Company has determined or has ordered the external individuals to perform. 

The Company may also disclose your personal information to relevant authorities or regulatory agencies to comply with the law. 

7. Owner’s Rights of Personal Data

As the owner of personal data, you have the right to take actions within the limits permitted by the law, as follows: 

1. You have the right to withdraw your consent for the collection, use, or disclosure of your personal data that you have previously given to the Company, throughout the period during which your personal data is with the Company. Withdrawal of such consent shall not affect the collection, use, or disclosure of personal data that you have previously consented to. Nevertheless, in the event of such withdrawal, it may result in services, product recommendations, or other recommendations not meeting your preferences, and it may also impact your eligibility for various promotions (“Right to Withdraw Consent”).

2. You have the right to access your personal data and request the Company to provide you with a copy of such personal data, as well as to request the Company to disclose how it has obtained your personal data without your consent (“Right to Access Data”).

3. You have the right to request the Company to correct your personal data to be accurate, up-to-date, complete, and not misleading (“Right to Correct Data”).

4. You have the right to request the Company to erase, destroy, or make your personal data unidentifiable (“Right to Erase Data”).

5. You have the right to request the Company to suspend the use of your personal data for certain reasons (“Right to Suspend Data Usage”).

6. You have the right to request to receive your personal data from the Company in the event that the Company has made such personal data available in a format that can be read or processed by automated tools or devices, and you can use or disclose your personal data using automated means. Additionally, you may request the transfer of such personal data in the same format to another data controller when it can be done automatically, or request to receive personal data that the Company has sent or transferred in the same format to another data controller directly (“Right to Data Portability”).

7. You have the right to object to the collection, use, or disclosure of your personal data for certain reasons (“Right to Object to Data Processing”).

8. You have the right to lodge a complaint with the Office of the Personal Data Protection Committee in cases where the Company, as the data controller or data processor (as the case may be), and its employees or contractors do not comply with the Personal Data Protection Act. You can request these rights by contacting the Company using the contact details specified in Section 12 of this notice. The Company will consider and respond to your request without undue delay or within the time frame specified by law. Please note that the exercise of your rights may be subject to limitations under relevant laws, and there may be cases where the company rejects or is unable to fulfill your requests. The Company reserves the right to refuse or be unable to act upon any of your requests if the law allows such refusal.

8. Cookie Policy

The Company uses cookies to store information about your website visits to help improve the quality, speed, security, and your privacy when using our services. When you use the Company’s services through its website, the Company utilizes cookies for the following purposes: 

  • Functionality Cookies: The Company uses cookies of this type to help remember your device or browser, allowing the Company to tailor content more rapidly to your personal interests. This improves the convenience and usefulness of the services and platforms to you. To disable the use of these cookies, you can adjust your device settings or browser by referring to the help feature of your browser or device. 
  • Analytic Cookies: The Company employs Analytic Cookies provided by Facebook, Google, and other service providers to analyze how website visitors use the site. This analysis is used to present products or services to you through advertising on social media. If you do not consent to the processing of your personal data by these external parties, you can configure your device settings by referring to your browser’s or device’s help feature. 

9. Personal Data Security

9.1 The Company has implemented appropriate security measures to safeguard personal data, aligning with data protection standards, in order to prevent data loss, unauthorized access, destruction, usage, alteration, modification, or unpermitted or unlawful disclosure of personal data, in compliance the Company’s data security standards. 

Additionally, the Company will continuously improve and test its data security systems to ensure the highest level of security and trustworthiness for your personal data. In doing so, the Company reserves the right to modify its security systems or tools if it deems that these changes will enhance data security and maintain a high standard of protection. The Company continually updates and tests security measures to ensure ongoing data safety. 

9.2 The Company Has a Process for Managing Personal Data Breaches 

9.3 In cases where the Company contracts with external entities to use personal data for processing, or in system development and maintenance, these external parties will only use your personal data as specified or directed. These external parties are also required to maintain confidentiality and protect your personal data. 

10. Connection to External Websites or Applications 

This personal data policy is exclusively for the services provided by the Company and the use of the Company’s website or applications. If you click on a link to another website or application, even if you access it through the Company’s website or application, you will need to review and comply with the personal data policy displayed on that website or application, separated from the Company. These websites or applications may have personal data policies that differ from the Company’s. The Company is not responsible for the content, policies, damages, or actions arising from third-party websites or applications. 

11. Personal Information Collected Before the Date the Personal Data Protection Act B.E. 2562 (2019) Came into Force

In cases where the Company has collected sensitive personal data from you before the effective date of the Personal Data Protection Act, B.E. 2562 (2019), and it is subject to the provisions of the said Act, the Company will continue to collect and use your personal data for the original purposes. You have the right to withdraw your consent by contacting the Company as specified in Section 12 of this announcement. 

12. Contact Channels 

If you have any questions or need to contact us to exercise any of your rights as a data subject, or if you have any complaints, you can reach us through the following channels: 

Areeya Property Public Company Limited 

Contact Location: No. 999 Pradit Manutham Road, Saphan Song Subdistrict, Wang Thonglang District Bangkok 10310 

Contact Channels: Contact the company via the website www.areeya.co.th or contact the Call Center on 1797. 

13. Reservation of Rights 

While this Personal Data Policy refers to Areeya Property Public Company Limited or its affiliated companies, it is meant to serve as a general policy of Areeya Property Public Company Limited or its affiliated companies. It does not bind such companies unless specifically agreed upon by companies requesting consent, companies that enter into a contract, or companies that you have requested to collect your personal data for the purpose of processing your request before entering into a contract and have taken action in accordance with that request. This may also include companies that are the data controllers for your personal data by law and are related to the purposes of this policy, and will not apply to other unrelated companies, even if they are affiliated companies. You agree not to make any claims against such unrelated companies mentioned above. 

14. Changes to the Personal Data Protection Policy 

The Company reserves the right to update, modify, or amend this Personal Data Protection Policy in whole or in part in the future, as deemed appropriate and in compliance with the law. In the event of any updates, modifications, or amendments, the Company will inform you through appropriate channels.   

This announcement shall be effective from June 1, 2022, and remain in effect until updated, modified, amended, or revoked.