Rocket Innovation Co., Ltd. (“the Company”) is established in Thailand. This Privacy Notice explains how we collect, use, and/or disclose your personal data. It applies if you deal with the Company as a customer, vendor, contractor, business partner, website or application visitor, or other third party — including when you are located outside Thailand.
The Company respects your privacy and is committed to protecting your personal data under the Thai Personal Data Protection Act B.E. 2562 (2019), as amended from time to time (the “PDPA”), and other laws and regulations issued under the PDPA. Where we process personal data of people outside Thailand, we still apply this notice and the safeguards described below, including for cross-border transfers.
Personal data means information about an individual that can identify that person, directly or indirectly. It does not include information about a deceased person.
The Company is the data controller for the processing described in this notice.
1. Purposes of collection, use, and disclosure
We collect, use, and disclose your personal data only as necessary for our lawful purposes. The main purposes are:
- To enter into and perform a contract with you, or to take steps at your request before entering into a contract, including preparing quotations and contracts.
- To process payments, collect or pay money, and for accounting, bookkeeping, and audit purposes, including issuing tax invoices and debt collection.
- To maintain a database for assessing customers and business partners.
- To verify your identity and to keep business contact details.
- To evaluate work performance, produce internal reports, analyse data, and manage work under a service or engagement contract.
- To comply with regulations and to support internal and external business reviews of the Company.
- To protect the security of the Company.
- For other legitimate interests of the Company, unless those interests are overridden by your fundamental rights in your personal data.
- For a specific purpose for which you have given consent to the collection, use, and disclosure of your personal data.
Our legal bases under the PDPA are: contract, the Company’s legitimate interests, compliance with a legal obligation, and consent (where consent is required). These map to the lawful bases commonly used in other jurisdictions, including contract, legitimate interests, legal obligation, and consent.
2. Sources and types of personal data
2.1 Sources
We collect your personal data from sources such as:
- Information you give us directly because you are a contractor, customer, or business partner of the Company, or other information you provide yourself.
- Information we receive from third parties because you are a customer or business partner of the Company — for example credit information, commercial information, information from our customers or your customers, and information from law-enforcement authorities.
- Communications between you and the Company, including records of telephone calls, letters, email, messages, conversations during office visits, or any other method.
- Information we receive, or may receive, when you use the Company’s website or application; and/or
- When you make your personal data clearly public, including disclosure on social media. In that case we collect only the information you have chosen to make public.
2.2 Types of personal data
- Identity data: first name, last name, gender, date of birth, national ID number, passport number, other government-issued numbers, personal data appearing on government identity documents, government-issued juristic-person documents (where you are a legal entity), tax identification number, nationality, photograph appearing on a national ID card, passport, or driving licence, signature, identity-verification data, photographs, CCTV images or recordings, and other data we request.
- Contact data: address, place of contact, telephone number, email.
- Financial data: bank account details, billing address, credit-card number, cardholder name, and other card details.
- Electronic data: IP address, cookies, and activity logs.
We may collect certain sensitive personal data in order to enter into a contract with you as a customer or business partner. We will not collect, use, and/or disclose that data without your explicit consent, unless the law allows us to do so.
2.3 If you refuse to provide personal data
If we need your personal data and you do not provide it, we may have to refuse related actions. For example, if we need the data to enter into a contract, you may not be able to contract with the Company.
2.4 Retention
We keep your personal data only as long as needed to fulfil the purposes of collection, use, and disclosure. We generally retain it for about 10 years after our relationship with you ends, then destroy, delete, or anonymise it. We may keep it longer where we have a legal reason to do so.
4. Disclosure of personal data
We may disclose your personal data to third parties such as service providers and professional advisers for the following purposes:
- To comply with any applicable legal requirement, or with service terms and other agreements.
- To protect the rights, property, and safety of the Company and of companies in our group.
- For legal process or legal proceedings.
- For a business transaction (for example a purchase, sale, lease, merger, acquisition, disposal, or financing of the organisation or any part of its business or assets) to which the Company is or may become a party.
We may also disclose or transfer your personal data to other third parties, including:
- Subcontractors, agents, or any service providers who work for or serve the Company — for example carriers, public-relations providers, and security providers — including their subcontractors, providers, supervisors, and staff.
- Government authorities, for permit applications or for the Company to comply with law.
- Law-enforcement authorities, government, courts, dispute-resolution bodies, the Company’s regulators, auditors, and any person appointed or requested by a regulator to review the Company’s activities.
- Auditors and other reviewers appointed or requested by a regulator, including for ISO certification.
- Persons appointed to administer any of your interests.
- Any person or company involved in a restructuring, merger, or acquisition that has occurred or may occur, including a transfer of any rights or duties the Company has under a contract with you.
- Any other person connected with a dispute, including a dispute about a transaction.
- Anti-fraud bodies that use the data to detect and prevent fraud and other financial crime.
- Financial institutions and payment-service providers.
- Intermediaries, contact persons, and your agents.
- Any person who instructs or administers your accounts, goods, or services on your behalf (for example an attorney-in-fact or lawyer); and/or
- Any person you have instructed us to disclose your personal data to.
If we must send your personal data to a data processor, we will contract with that processor so it has adequate measures to protect your personal data, so you can exercise your rights, and so legally enforceable remedies are available.
5. Cross-border transfer of personal data
We may send or transfer your personal data outside Thailand for storage and/or for collection, use, and disclosure in order to perform a contract between you and the Company. We will not allow unrelated persons to access that personal data.
Transfers are made in accordance with the PDPA. We put in place the necessary and appropriate safeguards. If you are outside Thailand, this may include transferring your data to or from your country so we can perform the contract or operate the website and related services.
6. Your rights
You have the following rights under the PDPA. These correspond to the data-subject rights recognised in many other jurisdictions:
- Right to withdraw consent.
- Right to access and obtain a copy of your personal data that we hold, or to be informed how we obtained personal data that you did not consent to provide.
- Right to receive your personal data and to have us send or transfer it to another data controller (data portability).
- Right to object to the collection, use, or disclosure of personal data.
- Right to request that we erase or destroy personal data, or make it so that it can no longer identify you.
- Right to request that we restrict the use of personal data.
- Right to request that we rectify your personal data.
We may refuse a request where the PDPA or other applicable law allows. To exercise these rights, contact us using the details in section 8.
7. Security of your personal data
We take the security of your personal data seriously. We regularly review and apply appropriate organisational, physical, and technical security measures when storing, collecting, using, and disclosing your personal data, so that it is not lost, accidentally destroyed, disclosed, used for an unintended purpose, or accessed by anyone other than employees or persons who collect, use, and disclose personal data on the Company’s instructions.
8. Complaints and questions
You may contact the Company to complain about how we collect, use, and disclose your personal data, or to ask a question, at:
Name: Rocket Innovation Co., Ltd.
Address: 5th Floor, Mobicom 3 Building, 101 Soi Praphinit, Naradhiwas Rajanagarindra Road, Thung Maha Mek, Sathon, Bangkok 10120, Thailand
Data Protection Officer: info@rocket.in.th
If the Company or its employees fail to comply with personal-data protection law, you may lodge a complaint with the Office of the Personal Data Protection Committee, 120 Moo 3, 6th–9th Floor, Ratthaprasasanabhakti Building, Government Complex Commemorating His Majesty the King’s 80th Birthday Anniversary, 5 December 2007, Chaeng Watthana Road, Thung Song Hong, Lak Si, Bangkok 10210, Thailand. Tel: +66 2 142 1033. Email: pdpc@mdes.go.th
If you are outside Thailand, you may also contact your local data-protection or privacy authority. The Thai PDPC remains the supervisory authority for this notice.
9. Changes to this Privacy Notice
We will review this Privacy Notice regularly and may change it as needed.
Relevant staff must inform third parties about this notice.
This Privacy Notice was last updated on 1 April 2024.