The Data Privacy Policy (for General Public)

This announcement provides the principles of collection, use and disclosure of personal data as specified by the Personal Data Protection Act B.E. 2562 (2019). This policy applies to employees of Wave Entertainment Public Company Limited and its subsidiaries (“Company”) and other person (such as a third party). Please read the terms of this notice carefully.

1. Definitions

“Personal data”, as described in this notice, is referred to data that relates to an identified or identifiable living individual, whether directly or indirectly. This includes data of any type that can be identifiable including but not limited to name, ID card number, address, online data, physical, mental, social, economic, cultural characteristic data or any identifiable data.

“Company” is referred to Wave Entertainment Public Company Limited and its subsidiaries.

“Subsidiaries” are referred to a company of which shares of more than 50% of the total capital are held direct or indirect by Wave Entertainment Public Company Limited.

“Minor” means those under the age of majority. A person ceases to be a minor and becomes a majority in two cases, namely (1) the completion of 20 years, and (2) not the completion of 20 years but upon legitimate marriage.

“Legal representative” means a person who in law has the right to do an act on behalf of a minor; or a person who must give a permission or a consent to a minor to do any act. Below is the list of legal representatives.

  1. Those exercising parental power: parents
  2. Guardians: those rather than parents who are appointed to be a guardian of a minor by an order of a court

2. A request of consent

A minor must receive a consent in writing by parents or a guardian under an order of the Court before allowing the Company to collect, use and disclose their personal data as per this notice and other applicable laws.

3. The data collected by the Company

3.1 General personal data

The Company must collect, use, disclose your personal data, including but not limited to:

  • Name and surname
  • Date of birth
  • Age
  • Social media accounts such as Facebook, Google, Instagram, Twitter and LINE, the account, IP address and cookies.
  • Photograph
  • Health or disability
  • Nationality and ethnicity
  • Religion
  • Sex
  • Marital status
  • Address, house registration and domicile data
  • ID card or passport
  • Phone number
  • Mobile number
  • Email
  • Tax identification number
  • Car number plate
  • Travel information
  • Payment data such as credit and debit card and bank account
  • Educational qualification and records
  • Occupation and workplace
  • Legal representative, the income of a legal representative and contact person
  • Financial and income data
  • Audio, visual, motion picture recording data at the Company’s establishments and the Company’s service location

3.2 Special types of personal data

The Company collects your special types of personal data in accordance with Article 26, the Personal Data Protection Act B.E. 2562 (2019) including ethnicity, race, political opinion, faith in religion, doctrine and philosophy, sexual behavior, criminal record, health data, disability, labor union data, genetic data, biometric data, or any other data of the same nature. The Company will carefully access, collect, use, reveal or control personal data under the boundary of the law. The Company will notify you of details of the collection, use and disclosure of special types of personal data before or while the Company collects such data from you under the terms and conditions required by law.

3.3 Personal data related to illegal offence

You acknowledge that in the event of an illegal offence, whether under civil, criminal, or any other laws, the Company has the rights to collect or use data about your illegal offence. The Company will carefully access, collect, disclose or control personal data under the scope permitted by law.

3.4 The Company collects, processes, uses the following personal data provided by a third party

You acknowledge and agree that the Company collects, processes, uses personal data including but not limited to:

  • Data on the public sources i.e. the data you disclose on social media or public media (Facebook, Instagram, Twitter) and the public data that contains your name, occupation and contact information.
  • The name, surname, ID card number, user account of social media such as Facebook and LINE, and the email address associated with the account, IP address, address, date of birth, sex, age, photograph, email, bank account number, credit and debit card number, phone number that the Company may receive from organizational bodies, financial institutes, agencies or partners of the Company etc.
  • The data about your health within the scope as permitted by law. The Company may collect data about your health from a hospital or any other medical facility or medical personnel.

Please note that, in order to protect and maintain the safety of the general public and to protect the interests of the Company, the Company has installed CCTV within the Company’s premises. The Company or a third-party service provider hired by the Company may collect, use and process data based on still or motion image that contains you and personal data that you use to enter the area of the Company.

4. Data processed by the Company

The Company processes personal data that the Company directly collects from you or by a third party as specified in Item 3 in order to provide service, facilitate fulfilment of the contract, ensure compliance with the law, for the legitimate benefit of the Company or for the purposes specified in Item 5.

The Company uses an automated decision-making process to process your data via computer systems in some cases. For instance, the Company may assess personal data for service, etc. You can ask for more details by reaching the Company’s a data protection officer.

5. The purposes and legal basis for collection, use and disclosure of your data

The Company collects, uses and discloses personal data according to the following purposes:

  • Identify or verify your identity.
  • Deliver, offer or publicize information about the Company’s services as per your interest through contact channels such as social media, emails, phones, etc.
  • Promote, develop and improve the business relationship between you and the Company.
  • Consider, process, test or analyze your interests to promote, develop and improve the Company’s service to meet your interests and needs to the fullest extent.
  • Train, control or guarantee employees and quality that may be involved in coordination or contact through channels with you.
  • Manage, solve problems, ask a question and analyze problems that may arise from the Company’s service. The Company will use such data only for necessity.
  • Manage, answer a question or respond to your communication, service complaint or suggestion.
  • Clarify, notify or inform the modification of the format or information related to the service of Company.
  • Check or prevent misbehavior, infringement, misconduct or violation against law, order, regulation and any other term of the Company.
  • Promote or publicize the advertising and promotional activities under the terms of the Company.
  • Issue an invoice, service fee collection, refund and receipt of payment.
  • Provide a computer system, internet and related services, and provide electronic educational services.
  • Comply with the laws, rules and notices engaged.
  • Facilitate fulfilment of the contract between the Company and you, or use for processing your request of service before entering into the contract with the Company.
  • Perform a duty in carrying out a mission for the public interest of the Company or perform a duty in the exercising of state power granted to the Company.
  • Protect the legitimate interest of the Company or other persons.
  • Ensure the benefit of the Company’s operation.

In the event that the Company must collect, use and disclose personal data for operational purposes according to the contract performance between the Company and you; or for use in processing your service request before entering into a contract with the Company, if you didn’t provide personal data to the Company, the Company may be unable to perform the contract or provide correct and complete service to you as required by the contract.

To comply with the law, the Company may need to collect, use and disclose special categories of personal data, including (1) the data that reveals racial or ethnic origin, political opinion, religious or philosophical beliefs, and a union membership, (2) biological data, and (3) health and sexual orientation. The Company shall collect, use, process and disclose the data in the following cases: (1) the Company receives your consent in performing such operation, (2) the Company must form a legitimate request, compliance or exercising a request right as per law, or assert a claim by law, or (3) for the significant public interest.

You can request more details by contacting a data protection officer when the Company collects, uses and discloses your sensitive personal data with your consent. You can revoke your consent at any time by contacting a data protection officer. After your consent withdrawal, the Company may still need to process personal data to comply with the law or to protect the interests of the Company. At the time of consent withdrawal, the Company will brief you the type of data whereby the Company still has a duty to collect or process for the purpose of compliance with the law.

Furthermore, the Company collects, uses and discloses personal data for other purposes that are additional, consistent or similar to the said objectives and also the objective of statistical, historical or scientific researches for the purpose of data storage (archive) for the public benefit. If possible, the Company will not use identifiable data for the above purposes. Alternatively, the Company will proceed to limit the scope of personal data that the Company will use to conduct a research or store backup data. The Company may use pseudonymous data to avoid your personal data use.

6. The recipients of your personal data

The Company recognizes the importance of ensuring adequate personal data protection. The Company tries to limit access to personal data to persons who need to access such data to perform their existing functions. Employees and personnel of the Company, its subsidiaries, alliances, third parties who are under the contracts to provide services to the Company regarding collecting, use and disclosure of the above-described personal data, and other contractual parties who act on behalf of the Company will receive, collect, use and disclose your personal data. The Company will disclose personal data to them only as necessary to process personal data to provide your service, to perform the contract between the Company and you as part of your request to use the service before entering into a contract with the Company, to perform duties in carrying out missions for the public interest of the Company, performing duties in exercising state powers granted to the Company and/or for the legitimate interests of the Company or other people. The Company agrees to protect your personal data from unauthorized use, access and disclosure. You may contact a data protection officer for further information on the types of service providers to which the Company will disclose your personal data. The Company may disclose your contact information stored in the staff directory to our employees and general public. However, you have the right to request an erasure of your data from the Company under the rules, conditions and time period set out by the Company.

The Company may provide your personal data to any other companies or agencies such as government agencies, public bodies, service supervisory agencies, the Company’s supervisory agencies, an agency which the Company is a part of it, or a government agency that controls immigration, taxes, national security and crime as required by law to operate the Company’s business or carry out mutual activity, travel, event, profession affiliations, and research.

In addition, you agree to allow the Company to disclose or transfer your personal data to its subsidiaries and partners for the Company’s operation, service provision, compliance of contracts between the Company, use in processing your service request before entering into a contract, performing duties in carry out missions in the public interest of the Company or in the exercise of state powers granted to the Company and/or to legitimate rights of the Company or other people, any notices to be enforced by the Company on a case by case basis.

7. Portability of personal data to abroad

The Company may transfer your personal data to foreign countries for the purposes of the Company’s operation only as necessary. In this regard, you agree and consent that the Company sends your personal data outside of Thailand to a person or an agency located in another country or under the jurisdiction of another country, whether or not the personal data protection laws in that country meets with the criteria or the standard of the personal data protection law of Thailand. The Company will take the suitable procedure to safeguard the security of your personal data at the same level as that of the personal data protection laws in Thailand.

8. The retention period

The Company will collect your personal data only as necessary and under the time specified by law. You can check for the retention period of your personal data by contacting the Company’s data protection officer.

9. Your rights

At any time, you have the following rights regarding your personal data.

  • The right to access your personal data held by the Company, and the right to request rectification of data that are inaccurate or incomplete.
  • The right to request electronic copies of personal data that you send to third parties or request the Company to send it directly.
  • The right to object to the processing of your personal data for marketing and any other legal purposes.
  • The right to request erasure of your personal data when it is not needed for storage purposes and the rights to limit the scope of processing of personal data in case that erasure cannot be completed.
  • The right to ask the personal data controller to suspend the use of personal data.
  • The right to request the Company to ensure that personal data is correct, up to date, complete and free of a misunderstanding.
  • The right to submit a complaint to a regulatory agency if you believe your rights have been infringed.

However, your exercise of rights must be subject to the terms and conditions formulated by the Company and is in accordance with the personal data protection Law, the Company’s data privacy policy and other criteria specified by the Company. By exercising the above-mentioned rights, you must submit a written request to the Company’s data protection officer with details stated in Item 10 of this notice. The consideration of such request is at the sole discretion of the Company. The Company’s decision in relation to your claim for rights is deemed final.

In the event that you request the Company to delete, destroy, limit the collection, use, processing or disclosure of personal data; suspend data usage temporarily; convert personal data with an unidentifiable data subject; and withdraw a consent, this request may cause a restriction regarding transaction or service provision to you by the Company.

10. Data protection officer

If you wish to exercise the rights set out in Item 9 or have a concern over the collection, use or disclosure of personal data, kindly inform a data protection officer as per these below details:

Data protection officer

Address 3199 Maleenont Tower, 15th Floor, Rama IV Road, Klongton, Klongtoei, Bangkok 10110

Email ir@wave-groups.com

11. A withdrawal of consent

If you do not want the Company to collect, use, process, disclose your personal data, you can request a consent withdrawal by submitting a request to the Company’s data protection officer.

However, a withdrawal of consent to such personal data must be subject to conditions, requirements, notices or regulations prescribed in the personal data protection law, the Company’s data privacy policy and other criteria imposed by the Company.

12. Modification

The Company reserves the right to amend this policy for any reason it deems appropriate, and under a compliance with the law, the public policies, rules, announcements, orders or other related subjects. In case of any update, the Company will publish it on the Company’s website www.wave-groups.com. The amendment will be effective immediately upon posting on the website and this means that you acknowledge and agree to comply with the revised data privacy policy in all respects. You should regularly check and go through the data privacy policy the Company posts on the website.