ประกาศแจ้งนโยบายการคุ้มครองข้อมูลส่วนบุคคล / Privacy Policy

Mr.FOX Co., Ltd. ("the Company") respects your privacy and places importance on protecting personal data and maintaining information security. This Privacy Policy explains the purposes and details of our collection, use, and/or disclosure of personal data, as well as your rights under applicable laws.

1. Who this policy applies to and data collection channels

1.1 Who this policy applies to

This policy applies to you if you are an individual customer or a juristic person customer, including individuals associated with such juristic persons (e.g., shareholders, directors, partners, representatives, employees, officers, and/or assignees) who use or used the Digital Signage Platform and related platforms within the Company group, or who contact us or receive information about our products and/or services through any channel.

1.2 Collection channels

• Data you provide directly or through interactions with the Platform and/or our channels, such as offices, websites, applications, social media accounts, email, phone, fax, mail, SMS, questionnaires, business cards, meetings, trainings, seminars, events, marketing activities, or other channels.
• Data we obtain or can access from other sources, such as government agencies, other group companies, related platform providers, business partners and their service providers, co-branded product/service partners, public sources (e.g., official gazettes), third-party social media/online platforms, or other parties with whom we have legal relationships.

2. What personal data we collect, use, and/or disclose

2.1 Personal data

Information that can identify you directly or indirectly, for example:

• 2.1.1 Personal details e.g., title, first name, middle name, last name, alias, gender, date of birth, age, marital/family status, number of family members/children, relationship data, nationality, country of residence, and government-issued documents (ID card, passport, visa, work permit, house registration, birth certificate, name change certificate, marriage/divorce certificate, death certificate, driver's license, or similar identity verification documents).
• 2.1.2 Contact details e.g., registered address, current address, nationality-country address, workplace, phone/mobile/fax, email, electronic communication or social media identifiers (e.g., LINE ID), and proof of residence in Thailand (for foreigners).
• 2.1.3 Employment details e.g., occupation, job field, position, tenure, job details, business type.
• 2.1.4 Technical/usage details e.g., IP/Mac address, Cookies ID, web beacons, pixel tags, SDK, Device ID, device model/type, network and connection/access data, SSO usage, logs/log-in data, access duration, search history, time zone and location data, browser plugin type/version, operating system and platform, and other device technologies used to access the Platform.
• 2.1.5 Other data e.g., communications and interaction records, complaints/opinions, rights requests, survey results, audio recordings, photos/videos, log/chat-bot communications, CCTV footage (per CCTV Privacy Policy), court orders/official gazette information relating to service use or legal compliance, and other personal data under applicable laws.

2.2 Sensitive personal data

The Company does not intend to collect sensitive personal data. However, in some cases it may be necessary to provide services/products, such as religion shown on an ID card, ethnicity shown on certain passports, biometric data (e.g., face/fingerprint/behavioral signature used for identity verification), criminal records, health, disability, sexual behavior, etc. We will process sensitive data only with explicit consent or where permitted by law.

2.3 Minors, incapacitated persons, and quasi-incapacitated persons

The Company does not intend to collect, use, and/or disclose personal data of minors, incapacitated persons, or quasi-incapacitated persons, unless we obtain consent from a parent/guardian/curator or where a minor can lawfully consent on their own, and/or under other lawful bases.

2.4 Child Safety and CSAM

• We strictly prohibit creating, uploading, posting, requesting, sharing, or possessing any child sexual abuse material (CSAM) or any form of child exploitation.
• No grooming, sexual harassment, trafficking, or other harmful behaviors involving minors.
• We may remove or restrict access to content, suspend/terminate accounts, and retain evidence as necessary for safety and enforcement.
• Where we have reason to believe CSAM or imminent harm is involved, we may report to relevant authorities as required by law.
• Reporting channel: in-app reporting (if available) or email worawutchitchak@gmail.com.

3. Purposes of processing

3.1 Purposes based on consent

• Processing sensitive personal data where other lawful bases are not available.
• Analytics, research, and/or statistics for development and improvement that require consent under law.
• Marketing, offers, benefits, news, tailored promotions, and marketing strategies that require consent under law.

3.2 Purposes based on other lawful bases

We process personal data as necessary for contract performance, legal obligations, legitimate interests, and/or other lawful bases, for example:

• Delivering products/services under contract (account opening/registration, data changes, verification, benefits, gifts, complaint handling, fulfilling requests, monitoring compliance, cancellations).
• Marketing activities that do not require consent under law (similar product/service offers, sales promotions, and drop-off follow-ups).
• Analytics/research/statistics that do not require consent under law.
• Customer relationship management and service communications.
• Internal administration, audit, governance, risk management, and reporting.
• Security and prevention/detection of unlawful or suspicious events (fraud, money laundering, terrorism, crime, IP infringement), including CCTV and access control.
• Legal compliance, court orders, and establishment/exercise/defense of legal claims.

4. Data disclosure

We may disclose personal data with your consent or as permitted by law, such as to:

• Group companies
• Service providers (technology, security, cloud, communications, marketing, analytics)
• Business partners/co-branded service entities
• Authorities as required/permitted by law

5. International transfers

We may transfer personal data abroad as necessary, with safeguards meeting legal requirements.

6. Cookies and similar technologies

We may use cookies and similar technologies on our websites and/or applications to remember preferences, improve experience, and enhance services. We may also share non-identifying data with analytics providers such as Google, which may use cookies/SDK to analyze usage as described by Google.

7. Retention

We retain your personal data during your relationship with us and as needed for the purposes of this policy. After the relationship ends, we may retain data as required/permitted by law, for example:

• Anti-Money Laundering laws: 5-10 years after relationship ends (case-dependent)
• Financial institution / securities / accounting / tax laws: 10 years after relationship ends

We will delete, destroy, or de-identify data when it is no longer necessary.

8. Security measures

We implement technical, administrative, and physical safeguards to maintain confidentiality, integrity, and availability, including access controls, permission management, and monitoring to prevent unauthorized access or disclosure.

9. Your rights

• Withdraw consent (which may affect certain services/benefits)
• Access and obtain copies, including data source disclosure
• Data portability (where applicable and technically feasible)
• Object to processing (including direct marketing and certain research/statistics)
• Erasure/deletion or anonymization
• Restriction of processing
• Rectification
• Lodge complaints with competent authorities

These rights may be limited under applicable laws. We may deny certain requests where necessary, and will inform you of the reasons. You can delete your account and data through the "Settings" page in the application, or contact us directly.

10. Policy updates

We may review and update this policy from time to time as appropriate and permitted by law, and will publish the current version on our website.

11. Contact and Data Protection Officer