Enrich Group’s Privacy Policy

Enrich States Company Limited and Subsidiary (the “Enrich”) acknowledges the importance of personal data protection of a customer (“the Customer”). Therefore, the Enrich uses the high standard and strict process for data protection of the Customer’s personal data from unauthorized access, use, change or disclosure or not in good faith.

Scope of application.
This privacy policy is made for the purpose to inform the Customer as a data subject that what kind of personal data that is collected, used and/or disclosed by the Enrich, ground to use and/or disclose personal data by the Enrich, data retention period, rights of the Customer about his/her personal data under applicable laws.
The Enrich may review, amend this policy from time to time in compliance with applicable laws and/or subordinate legislation, regulations, announcement of any government authority which will be newly issued. If there is any amendment on this policy, the Enrich will publish the updated version as early as possible to be up-to-date and in accordance with the new legislation.

Personal data where the Enrich collects, uses and/or discloses.
Personal data under applicable means any data of an individual which can identify such Customer whether directly or directly (except for the deceased) and irrespective of whether is provided by the Customer or in possession of the Enrich or received by the Enrich and/or accessed from other reliable sources (as set forth herein). Personal data of the Customer that is collected by, used by and/or disclosed by the Enrich is general personal data and sensitive data.
– Identification Information such as first name/last name, identity card number, passport number, birth date, address, e-mail address, telephone number etc.
– Financial Information such as income information, history of credit information with the Enrich or repayment records, information from the Execution Department etc.
– Marital Status such as single, married etc.
– Favorite behavior of the Customer to search information through the internet (Online Behavior Information) such as Website Browsing or connection to other website of the Customer etc.
– Audio / Visual Information when the Customer contacts the Enrich at the address of the Enrich or does transactions through the Video Call or telephone number of the Enrich through TMB Contact Center.
– Sensitive Data means personal data about race, religion, politic opinion, criminal record, labor union, biometric data, health information, credit information, biometric data used for verification of the Customer such as fingerprint, face recognition, eye scan, voice recognition etc. The Enrich has no policy to collect sensitive data of the Customer except for receiving prior consent from the Customer or necessity basis for the purpose of (a) identity authentication and/or (b) as electronic signature with the Enrich when doing transactions with the Enrich through digital channel, branch or website of the Enrich.
Hereinafter referred to both types of personal data as the “Data”.
The Enrich may collect personal data of the Customer from reliable sources such as the Development Business Department, Department of Provincial Administration, Department of Consular Affairs, the Ministry of Foreign Affairs, Credit Bureau Company, the Legal Execution Department including without limited to financial institutions, financial group and/or the Enrich’s business partners and/or financial advisors etc.

Rights of the Enrich to collect/use and/or disclose personal data.
1. Customer’s name
2. Gender
3. E-Mail address
4. Physical address
5. Office info
6. Phone number
7. IP Address
8. Web Browser
9. Domain
10. Visited website
11. Time of visited website
12. Reference website
13. Info of the transaction and set up
14. Any favorite on internet usage

Customer’s Information Enrich Shared.
The Enrich will not share or disclose the Customer’s personal data to a third party who is not within the Enrich’s group except for (i) receiving the Customer’s consent (ii) do transactions in compliance with the Customer’s intention (iii) disclosure as required by laws or the orders of any regulatory bodies. The Enrich discloses personal data of the Customer to the following recipients;
1. The Enrich’s group which consists
Enrich States Co., Ltd.
Enrich Villa Co., Ltd.
Enrich Development Co., Ltd.
Enrich Poranimmit Co., Ltd.
SG Enrich Co., Ltd.

2. Outsource service providers whether located in Thailand or abroad such as software developers, marketing events service providers, data research service provider, cloud service provider, debt collection provider etc.
3. Government authorities and/or regulators.

Protect Policy.
The Enrich has implemented policies, manual and minimum standard to manage the Customer’s personal data both technical measure and organizational measure such as information technology safety standard or the policy on confidential information of customers etc. The Enrich has improved such policies, manual and minimum standard from time to time in accordance with requirement under applicable laws.
In addition, officers, employees and contractors of the Enrich have duty to protect personal data of customers in accordance with confidentiality agreement signed with the Enrich.
If the Enrich needs to send or transfer personal data of the Customer abroad that has less standard of customers’ data protection, the Enrich will take action as necessary at least equal to the standard of confidentiality of that country such as having confidential agreement with a party in that country etc.

Rights of a Customer about his/her personal data.
The Enrich acknowledges the importance of the Customer’s rights under the Personal Data Protection Act where the Customer should know as follows;
1. Right to Withdraw or Cancel Consent
The Customer shall have the right to withdraw or cancel consent previously given to the Enrich for collection, use and/or disclosure of the Customer’s personal data at any time except that such right of withdrawal or cancellation is limited under applicable laws or contracts which give benefit to the Customer such as the Customer still uses service or product(s) of the Enrich or the Customer still has contingent liability with the Enrich.
2. Right to Access Information
The Customer shall have the right to access and receive his/her personal data which is in possession of the Enrich or request the Enrich to disclose acquisition of such information under which the Customer does not give consent.
3. Right to Data Portability
The Customer shall have the right to access his/her persona data with the Enrich in the event where the Enrich has made such personal data in readable format or usable by any automatic equipment or device and capable of using or disclosing automatically including (a) right to request the Enrich to send or transfer personal data to another data controller when capable of doing so or (b) right to receive data where the Enrich send or transfer data in such format to another data controller directly except for that it is technically impossible.
4. Right to Object Profiling
The Customer shall have the right to object collection/using or disclosing personal data of the Customer as follows;
For information collected from necessity for public interest of the Enrich or necessity for legitimate interest of the Enrich except for that the Enrich can show more importance of legitimate interest or establishing legal claim, complying with or raising legal excuse under applicable laws.
For collection, use or disclosure of personal data on direct marketing purpose.
For collection, use or disclosure of personal data for the purpose of scientific, historical, statistic area except for necessity to accomplish public interest tasks of the Enrich.
5. Right to Erasure
The Customer shall have the right to request the Enrich to erase or destroy or anonymize personal data of the Customer in the following events;
When the personal data is unnecessary for retention in accordance with the purpose of collection, use or disclosure.
When the Customer as the data subject has cancelled consent for collection/use or disclosure of personal data and the Enrich has no legitimate interest to collect, use or disclose personal data.
When the Customer argues on the collection/use or disclosure of personal data as the personal data is no longer necessary for collection/use or disclosure under the purpose given or for direct marketing.
When the personal data is collected, used or disclosed unlawfully.
6. Right to Restrict Processing
The Customer shall have the right to restrict the use of personal data in the following events;
During the investigation pursuant to the Customer’s request.
Personal data which must be erased or destroyed because it is illegitimate collection/use or disclosure by the Customer requests to suspend the use instead.
When the personal data is no longer necessary to retain information in accordance with the purpose of collection on such customer’s personal data but the Enrich must retain for establishing legal claim, complying with or legal enforcement or legal argument under applicable laws.
When the Enrich is proving that the Enrich’s legitimate interest is more important or establishing legal claim, complying with or raising excuse against legal claim after the Customer objects to the collection/use/disclosure by the Enrich.
7. Right to Rectification
The Customer shall have the right to request the Enrich to amend information to be up-to-date, correct and not misleading.
8. Right to Complaint
The Customer shall have the right to file a complaint to the specialist committee if the Enrich or any data processor is in breach of the Personal Data Protection Act and/or any ministry regulations or announcement issued under the said Act.

Rights of the Customer set forth above limit to the data where the Customer provided to the Enrich but excludes data where the Enrich has prepared such as credit opinion whether to grant credit facility or otherwise and depend on relevant factors where the Enrich may not proceed in accordance with the Customer’s request such as legitimate interest of the Enrich and the Personal Data Protection Act becomes effective and in accordance with the requirements promulgated by the Office of the Personal Data Protection Committee. For example,

Customer’s duty to provide personal data.
The Enrich will be able to provide service to the Customer on contractual basis when the Enrich receives personal data of the Customer in accordance with Know Your Customer and Customer Due Diligence to be up-to-date. Consequently, it is necessary that the Customer shall co-operate with the Enrich on this action as well.

Duration Enrich keeps personal data of the Customer.
If the Customer ceases to be customer of the Enrich or has terminated relationship with the Enrich, the Enrich will retain personal data for back-up purpose as required by applicable laws and in accordance with policy.

Contact channel.
If the Customer wishes to contact or has inquiry about information on collection/use/disclosure of personal data and/or rights of the Customer hereunder or to withdraw or cancel consent on marketing purpose or informs the Enrich on illegitimate use of his/her personal data, the Customer can contact the Enrich through;
ENRICH Call Center 02-4224222

Enrich States Co., Ltd.
2nd Floor, Office 2C
588 O Tower, Nakorn In Road, Bang Khun Kong, Bang Kruai, Nonthaburi 11130