Privacy policy for customers

SCG Cement-Building Materials Company Limited and its affiliates (as listed in the annex) (collectively referred to as "we") respect the privacy rights of our individual customers and related person (hereinafter referred to as "you"). To ensure that your personal data is protected, we have developed this privacy policy to inform you details regarding the collection, use, disclosure, deletion, and destruction (collectively, the "processing") of your personal data, both online and offline, in accordance with applicable personal data protection laws.

1. Processing Objectives: We will process your personal data

1.1 To conduct activities in response to your pre-contractual request, to perform our obligations in the contract to which you are the counterparty such as selling the products or providing the services, including managing your account, making deliveries, proceeding with accounting and financial matters, providing after sales services, processing returns or refunds, and performing obligations under franchise agreement.

1.2 To the extent necessary for legitimate interests

(1) To manage, develop, and conduct our business operations which include performance of obligations under franchise agreement, administration and development of websites and applications, fraud prevention and detection, crime prevention, relationship management for current and potential customers, maintenance of information technology (IT) systems;

(2) To protect your security such as provision of security measures, protection of your personal data, access control and identity authentication when you log in to your user account;

(3) To conduct marketing activities, research and data analysis which include sending news and privileges to you via emails, SMS, applications, social media, telephone, and direct mails, and to conduct questionnaires and interviews with you; and

(4) To establish, exercise, or defend your or our legal claims.

1.3 To protect life, body and health of you and third party such as communication in case of emergency and control and prevent disease.

1.4 To enable us to comply with laws, regulations and order of the competent authorities.

1.5 To perform mission or activities for public interest or in the exercise of official authority vested in us.

1.6 With your consent, we process your personal data to:

(1) Enable us, the companies in our group, and our partners to send news and privileges to you via emails, SMS, applications, social media, telephone, and direct mails; and

(2) Conduct other activities which we might have to collect additional personal data about you in which case we will inform and request your new consent from time to time. You can find out more about consent in item 4 of this privacy notice.

2. Personal data to be collected

2.1 When you use our services, purchase our products, become a member of our website, application, or privilege card (e.g. SCG Family); we collect the following personal data:

(1) Personal information such as ID cards, ID number, title, name, surname, date of birth, mobile number, email, marital status, conversation history, passport, facebook account, LINE account, photograph of your residence, floorplan of your residence, health information (only when you use our health-related services);

(2) Contact information such as email address, telephone number, home address, office address, social media account;

(3) Information related to your work such as occupation, position, work experience;

(4) Information related to purchase of products or services such as purchase history, claim history, complaints;

(5) Financial information such as bank account number, credit or debit card information, income, benefits, payment history; and

(6) Personal data you have given to us when you contact us, request our after sales services, participate in our research or interviews.

2.2 When you visit our website or application or purchase our products or services online, we collect the following personal data:

(1) Information about your registration such as name, email address, mobile number, passwords;

(2) Information about electronic devices that you use, such as IP Address, location data, and other device identifier;

(3) The type and version of the browser you use and the type and version of a plug – in;

(4) Time Zone setting.

2.3 When you visit our store or premises; we collect, monitor, and process your images, video, and audio recorded by CCTV which can be used to identify you. However, we will display notice signage where CCTV are in operation.

2.4 When you contact us or participate in any activity with us, such as contacting the contact center, take part in a customer satisfaction survey, and participate in our loyalty activities; we collect the following personal data:

(1) Personal information, such as name, surname, date of birth, photograph, identification card number, passport number, health information;

(2) Contact information such as telephone number, email, address; and

(3) Information about your participation in our activities, such as previous history of activities, photographs taken during your participation

2.5 We may need to collect and process special categories of personal data, as defined by personal data protection law, to fulfill the objectives we set out in this privacy policy such as

(1) for our security purposes e.g. facial recognition, finger print to verify your identity;

(2) In some cases, we may collect your special categories of personal data though they are not directly relevant to the products or services provided by us. For instance, we may obtain your religious belief when we collect copy of your identification card in order to identity you in taxation process; and

(3) We may collect your health information, e.g. food allergies, when we organize a customer relationship activity.

2.6 Where necessary, we will process your special categories personal data only when you give us explicit consent or for other purposes as required by law. We will try our best to provide adequate security measures to protect your special categories personal data.

2.7 If you enter into a franchise agreement with us, we will collect relevant personal data (such as directors, employees, operators, and customers of the franchisee) such as:

(1) Personal information such as name, surname, nickname, date of birth, photo, information shown on your ID card, driving license;

(2) Contact information such as phone number, email, address, contact methods on social media, address, telephone number, and business fax numbers;

(3) Information about work, such as occupation, position, start date, affiliation, training records, work records; and

(4) Educational information.

3. Cookies and other similar technologies

We use cookies and similar technology to collect personal data as specified in our Cookie Policy.

4. Consent, Withdrawal and Consequences

4.1 You are entitled to withdraw your consent at any time but such withdrawal will not affect the validity of the processing made prior to the withdrawal of consent.

4.2 Your withdrawal of consent or refusal to provide certain information may result in us being unable to fulfill some or all of the objectives stated in this privacy policy.

4.3 If you are under 20 years of age, you shall, prior to giving the consent, inform us of your parent or guardian so that we shall also be able to ask consent from them.

5. Retention Period

5.1 We will retain your personal data for the period necessary to meet the objectives unless the law requires longer retention periods. In the event that such period is unclear, we will retain the data for a customary expected period in accordance with retention standards (e.g. the prescriptive period of 10 years for general legal claims).

5.2 We have established an auditing system to delete or destroy your personal data when the retention period expires or when it becomes irrelevant or unnecessary for the purposes of collecting that personal data.

5.3 In case processing with your consent, we will cease processing when you have withdrawn your consent. However, we may keep your personal data to record your withdrawn so we can respond to your request in the future.

6. Disclosure of your personal data

6.1 We disclose and share your personal data with:

(1) Companies in our group (“affiliates”) and partners who provide services and sell products relating to construction materials and home appliances and

(2) Individuals and entities which are not our affiliates ("third parties") for the purpose of collecting and processing personal information as described in this privacy policy such as our dealers, transport and logistics service providers, postal service providers, data processing service providers, marketing service providers (who might send messages to you to promote our products and services), contractors (who might perform tasks on our behalf), financial service providers (such as banks, payment companies, electronic payment service providers, credit providers), IT service providers (such as providers of cloud services, blockchain systems, data analytics, SMS, or emails), IT developers, programmers, auditors, consultants, advisors, government agencies (e.g. the Revenue Department, the Anti-Money Laundering Office), insurers, and other persons to the extent necessary to enable us to conduct business, provide products and services, and meet the purposes for the collection and processing of personal data as described in this privacy policy.

6.2 We will require persons receiving your personal data to take appropriate measures to protect your personal data, process the data properly and only as necessary, and prevent unauthorized use or disclosure of your personal data.

7. Transferring personal data overseas

7.1 We may send or transfer your personal data to our affiliates or other persons in a foreign country if it is necessary in order for us to perform our obligations in the contract to which you are the counterparty or contract between us and third party for your benefit, to respond to your pre-contractual request; to protect your and third party’s life, body and health, to comply with laws or to the extent necessary for the public interest activities.

7.2 We may store your information on a computer, server, or cloud provided by a third party. And may use third-party programs, applications and platforms in processing your personal data. However, we will not allow unrelated parties to access to your personal data and will require such parties to have appropriate security protection measures.

7.3 In the event that your personal data is transferred to a foreign country, we will comply with applicable personal data protection laws and take appropriate measures to ensure that your personal data is protected and you can exercise your rights in accordance with the laws. Moreover, we will require those who receive the data to have appropriate protection measures for your personal data, to process such personal data only as necessary, and to take steps to prevent unauthorized use or disclosure of your personal data.

8. Security measures

8.1 We have implemented appropriate technical and administrative standards to protect your personal data from loss, misuse, and unauthorized access use, disclose, or destruction. We use technology and security procedures such as encryption and access restriction to ensure that only authorized people shall have access to your personal data, and that they are trained about the importance of protecting personal data.

8.2 We provide appropriate security measures to prevent the loss, access, use, change, disclosure of personal data from those who do not have rights or duties related to that personal data. We will review the above-mentioned measures when necessary or when the technology changes to ensure effective security.

9. Your rights as a data subject

9.1 You have the rights under the personal data protection laws, summarized as follows:

(1) Withdraw the consent you have given to us;

(2) Request to view and copy your personal data or disclose the source where we obtain your personal data;

(3) Send or transfer personal data that is in an electronic form as required by personal data protection laws to other data controllers;

(4) Oppose the collection, use, or disclosure of your personal information;

(5) Delete or destroy or make your personal data non-personally identifiable (anonymous) information;

(6) Suspend the use of your personal data;

(7) Correct your personal information to be update, complete, and not misleading.

(8) Complain to the Personal Data Protection Committee in the event that we, our data processors, our employees, or our contractors violate or do not comply with personal data protection laws. In this regard, we will consider your request, notify the result of the consideration, and execute it (if appropriate) within 30 days from the date we receive the request. Your rights mentioned above will be in accordance with the personal data protection law.

9.2 You can exercise your legal rights by visiting "privacy settings" on the website or websites (www.cottolife.com, https://cpacconnect.com, www.tigerbrandth.com, www.biminone.com, https://www.cpac.co.th, https://scghome.com, https://www.scgbuildingmaterials.com/th/, and www.chivitdonline.com) that you have given your personal data. If you did not give your personal data to us via these websites, you can ask us about how to use your legal rights by calling 02-586-2222. Please note that you will be able to exercise your rights when the law is enforced.

10. Information about data controller and Data Protection Officer

10.1 If you give personal data to SCG Cement-Building Materials Company Limited, the data controller is:

10.2 If you give personal data to a company other than SCG Cement-Building Materials Company Limited, the company that determines the purposes and means of the processing of your personal data is the data controller. Details of these data controllers are available in the annex to this privacy notice.

10.3 In the event that you have a question regarding personal data protection, please call 02-586-2222 or send your message to data.privacy@scg.com

In the event that this privacy policy is amended, we will announce a new privacy policy on this website, which you should periodically review the privacy policy. The new privacy policy will be effective immediately on the date of announcement.