Privacy Notice for Our Customers and Related Persons SCB Asset Management Company Limited

1.1.Our legal obligation

We are regulated by many laws, rules, regulations, and orders of any competent governmental, supervisory or regulatory authorities, and to fulfil our legal and regulatory requirements, it is necessary to collect, use or disclose your personal data for the following purposes, which include but not limited to:

a) Compliance with laws e.g. Financial Institution Business Law, Securities and Exchange Laws, Anti-Money Laundering Laws,  Prevention and Suppression of Financial Support to Terrorism and the Proliferation of Weapons of Mass Destruction Laws, and other laws to which we are subject both in Thailand and in other countries), including conducting identity verification, background checks and credit checks, Know Your Customer/Customer Due Diligence (KYC/CDD) processes, other checks and screenings (including screening against publicly available government law enforcement agency and/or official sanctions lists), Taxation Laws, and ongoing monitoring that may be required under any applicable law (e.g. investment limits); and/or

b) Compliance with regulatory obligations and/or orders of authorized persons by law (e.g. orders by any court of competent jurisdiction or of governmental, supervisory or regulatory authorities or authorized officers).

1.2. Contract made by you with us

We will collect, use or disclose your personal data in accordance with the request and/or agreement made by you with us, for the following purposes, which include but not limited to:

a) process your request prior to entering into an agreement, consider for approval and provide products and/or services, processing your applications or requests for services or products, deliver our products and/or services to you, provide advice and deal with all matters relating to products and/or services including any activities that if we do not proceed, then our operations or our services may be affected or may not be able to provide you with fair and ongoing services;

b) authenticate when entering into, doing or executing any transactions (e.g. sending your identification card data to the Department of Provincial Administration for verifying the status of your identification card);

c) carry out your instructions (e.g. to submit your orders, processing your applications and/or your transactions, fulfil a request for utilization of products and/or services, responding to your enquiries or feedbacks, or to resolving your complaints), including record images, videos and/or voices and/or any similar actions to enable us to efficiently carry out your instructions and/or to keep record as an evidence for proceeding with your instructions;

d) provide online investment, mobile applications (e.g. SCB PVD Online, SCB MyProvident, PF Online and SCBAM Fund Click) and other online product platforms

e) track or record your transactions, rights and benefits;

f) produce reports (e.g. transaction reports requested by you or our internal reports);

g) notify you with transaction alerts and notify the due date of products and/or services;

h) recover the money which you owe (e.g. when you have not paid for your outstanding fees);

i) carry out account maintenance and operations relating to your accounts, including without limitation, carrying out your request for services or products.  processing your transactions, generating your confirmation letter, investment report, investment confirmation letter and account statement, and operating and closing your accounts;

j) carry out account maintenance and operations relating to your user accounts and/or fund accounts, including but not limited to, processing your applications or requests for services or products, processing your transactions, generating your confirmation letter, investment report, investment confirmation letter and account statement of your user accounts and/or fund accounts, and operating and closing your user accounts and/or fund accounts;

k) enforce our legal or contractual rights;

l) provide IT and helpdesk supports, create and maintain codes and user accounts for you, manage your access to any systems to which we have granted you access, and remove inactive accounts;

m) provide investment products to you (including investment products of third parties that you may be interested) from time to time and deal with all matters relating to the investment products;

n) provide mutual fund management services (e.g. open account with bank custodian, make onshore and/or offshore investment and appoint a beneficiary);

o) provide private fund management services (e.g. fund set up, open deposit account and securities account, increase and decrease investment amount, enter into ISDA for and on behalf of private fund and proceed on related transaction with custodians);

p) open an omnibus account for buy, sell and switch unit-linked insurance products;

q) provide provident fund management services (e.g. fund set up, withholding tax submission to the Revenue Department and other ongoing registrar management); and/or

r) provide fund manager services for property fund, infrastructure fund and digital assets and provide trustee services for REITs; and/or

s) in the event of sale or transfer of claims, assets, debt or business, merger, reorganization, rehabilitation, or similar event, we may disclose and transfer your personal data to one or more third parties who are the transferees of claims, assets, debt, or business, or the parties involved in the merger or reorganizing, or the plan preparers and plan administrators, or those related to such similar event.

1.3. Our legitimate interests

We rely on the basis of legitimate interests by considering our benefits or third party’s benefits with your fundamental rights in personal data which we will collect, use or disclose for the following purposes, which include but not limited to:

a) conduct our business operation, the business operation of companies in SCBX Group as specified in https://www.scbx.com/th/affiliates-financial-business-group.html and the business operation of SCBX Group (e.g. to govern, to audit, to conduct risk management in business operations and internal management, to manage and audit financial and accounting, to manage the provision of services associated with our products or services, to conduct information technology and cybersecurity management, to conduct procurement management, to conducthuman resource management, to define guidelines and strategic planning for business operations, to plan and allocate personnel for operational tasks, to conduct debt restructuring and manage the risks of customers, to monitor, prevent and investigate fraud, money laundering, terrorism, misconduct, or other crimes, including but not limited to carrying out the creditworthiness checks of any persons related to our corporate customer, which may not be required by any governmental or regulatory authorities, and authenticating your identity to prevent such crimes);

b) conduct our relationship managements (e.g. to serve and facilitate you, to conduct survey, to manage customer segmentation, to handle complaints, to calculate remuneration for selling agent) including recording images, videos and/or voices and/or any similar actions to enable us to efficiently conduct our relationship managements and/or to enhance our services;

c) ensure security (e.g. to maintain CCTV records, to register, exchange card and/or take photo of visitors before entering into our premises);

d) develop, and improve our products, services and systems to enhance our services standard and/or for the greatest benefits in fulfilling your needs , including to conduct research, analyse data and offer products, services and benefits suitable to you by considering the fundamental rights in your personal data. If you do not wish to receive the offering of products, services and benefits from us, you can contact us through SCBAM Client Relations Tel. 02-777-7777 during office hours.

e) record images, videos and/or voices relating to the meetings, trainings, seminars, recreations or activities (e.g. marketing activities, corporate social responsibility activities, activities to support customer’s business) and use such recorded images, videos and/or voices for the purpose of making internal and/or external public relations relating to such meetings, trainings, seminars, recreations or activities;

f) in case of our corporate customer, we will collect, use and disclose personal data of directors, authorized persons, attorneys, guarantor, beneficiary, or any other persons, including personal data of such person as an individual customer, to execute transaction, provide services and/or contact corporate customer;

g) in case of our individual customer, we may collect, use and disclose personal data of any other person relating to your transaction or use of services (e.g. spouse, guarantor) to execute transaction and/or provide services to you;

h) ensure our business continuity, the business continuity of companies in SCBX Group and the business continuity of SCBX Group;

i) handle claims and disputes, file lawsuits and process the relevant legal proceedings;

j) contact you prior to your entering into a contract with us;

k) evaluate suitability and qualifications, issuance of request for quotation and bidding, and execution of contract with you;

l) protect against security risks (e.g.  monitoring network activity logs, detecting security incidents, conducting data security investigations, and otherwise protecting against malicious, deceptive, fraudulent, or illegal activity);

m) comply with applicable foreign laws or cooperate for compliance with applicable foreign laws;

n) analyse, carry out research, plan and conduct statistical analysis (e.g. on your investment limit and investment behavior, data analytics, assessments, surveys and preparations of reports on our products and/or services and your behavior, carry out our campaigns or our business opportunities);

o) carry out our project or events (e.g. promotional campaign, social activities, events for supporting our business and/or our customer’s business), conferences, seminars, and company visits, including to give reward as per promotional campaign or events;

p) facilitate financial audits to be performed by auditors;

q) receive advisory services from legal counsels, financial advisors, and/or other advisors appointed by you or us;

r) prepare a summary report for consideration and/or disclose your personal data to one or more third parties who are interested to be the transferees of claims, assets, debt, or business, or are interested in merger or reorganizing, or those related to such similar event before sale, or transfer of claims, assets, debt or business, merger, reorganization, or similar event;

s) in the event of any contemplated or proposed sale, transfer, merger, reorganization, or similar event, we may disclose and transfer your personal data to one or more third parties as part of that transaction;

t) maintain and update lists and directories of the customers (including your personal data) and keep contracts and associated documents in which you may be referred to;

u) comply with reasonable business requirements (e.g.  management, training, auditing, reporting, control or risk management, statistical and trend analysis and planning or other related or similar activities, implementing business controls to enable our business to operate, and enabling us to identify and resolve issues in our IT systems, to keep our systems secured, performing our IT systems development, implementation, operation and maintenance);

v) undertake fraud prevention model development, underwriting model development, collection model development, and proxy income model development, and track propensity to approve model performance;

w) facilitate you and a financial institution that grants credit facility to you to receive and/or deliver your information relating to the provident fund’s contributions and credit facility in the case where you are member of the provident fund and apply for provident fund welfare loan with a financial institution approved by us; and/or

x) apply for accidental insurance and/or life insurance for your benefit in the case where you are member of the provident fund which additionally provides accidental insurance policy and/or life insurance policy (as the case may be). 

1.4. Your consent

In certain cases, we may ask for your consent to collect, use or disclose your personal data to maximise your benefits and/or to enable us to execute transactions or provide services to fulfil your needs for the following purposes, which include but not limited to:

a) collect, use or disclose your sensitive personal data for the purpose of offering or providing products, services and benefits suitable to you. To proceed with such activity, we will research, conduct statistical data, analyse or develop such products, services and benefits (in case where consent is required under the PDPA);

b) collect and use your personal data and any other data to conduct research and analyze for the greatest benefits in developing products and services to truly fulfil your needs and/or to contact you for offering products, services and benefits exclusively suitable to you;

c) contact you to provide financial advice and offer our products, services, and benefits which may interest you (in case the consent is required under the PDPA);

d) send or transfer your personal data and sensitive personal data overseas, which may have inadequate personal data protection standards (unless the PDPA specifies that we may proceed under other lawful basis or without obtaining consent); 

e) when you are classified as a minor, incompetent or quasi-incompetent whose consent must be given by their parent, guardian or curator (as the case may be) (unless the PDPA specifies that we may proceed without obtaining consent);

f) disclose your personal data and any other data to companies in SCBX Group as shown on https://www.scbx.com/th/affiliates-financial-business-group.html and our trusted business partners for the purpose of offering or providing products, services and benefits to you. To proceed with such activity, companies in SCBX Group and our trusted business partners will research, conduct statistical data, analyze or develop products, services and benefits suitable to you;

g) disclose your personal data and any other data to companies in SCBX Group as shown on https://www.scbx.com/th/affiliates-financial-business-group.html and our trusted business partners for purpose of analyzing, carrying out research, and preparing statistical data, which will be beneficial in providing services that are more efficient and suitable for you; and/or 

h) other activities which we may require your consent.

1.5. Other lawful basis

Apart from the lawful basis which we mentioned earlier, we may collect, use or disclose your personal data based on the following lawful basis:

a) prepare historical documents or archives for the public interest, or for purposes relating to research or statistics;

b) prevent or suppress a danger to a person’s life, body or health; and/or

c) necessary to carry out a public task, or for exercising official authority.

If the personal data we collect from you is required to meet our legal obligations or to enter into an agreement with you, we may not be able to provide (or continue to provide) some or all of our products and services to you if you do not provide such personal data when requested.

In addition, we may utilize technologies currently possessed or to be acquired in the future for the collection, use, or disclosure of your personal data in accordance with the purposes stated in clauses 1.1 – 1.5 above, including but not limited to Artificial Intelligence (“AI”), Generative AI Usage such as AI Chatbot technology, Cloud Computing, etc.

Furthermore, as we may establish the system(s) and/or use the shared system(s) with the companies in SCBX Group, your personal data held by us and by companies in SCBX Group may be collected, used or disclosed through such system(s) to support our operations and business activities and/or operations and business activities within SCBX Group. To proceed with such activity, we will comply with the PDPA.

4.1 Right to access and obtain copy

You have the right to access and obtain copy of your personal data retained by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.

4.2 Right to rectification

You have the right to rectify your inaccurate personal data or to update your incomplete personal data.

4.3 Right to erasure

You have the right to request us to delete, destroy or anonymise your personal data, unless there are certain circumstances where we have the legal grounds to reject your request.

4.4 Right to restrict

You have the right to request us to restrict the use of your personal data under certain circumstances (e.g. when we are pending examination process in accordance with your request to rectify your personal data or to object the collection, use or disclosure of your personal data, or you request to restrict the use of personal data instead of the deletion or destruction of personal data which is no longer necessary as you have necessity to retain it for the purposes of establishment, compliance, exercise or defense of legal claims).

4.5 Right to object

You have the right to object the collection, use or disclosure of your personal data in case we proceed with legitimate interests basis or for the purpose of direct marketing, or for the purpose of scientific, historical or statistic research, unless we have legitimate grounds to reject your request (e.g. we have compelling legitimate ground to collect, use or disclose your personal data, or the collection, use or disclosure of your personal data is carried out for the establishment, compliance, or exercise legal claims, or for the reason of our public interests).

4.6 Right to data portability

You have the right to receive your personal data in case we can arrange such personal data to be in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means. Also, you have the right to request us to send or transfer your personal data to third party, or to receive your personal data which we sent or transferred to third party, unless it is impossible to do so because of the technical circumstances, or we are entitled to legally reject your request.

4.7 Right to withdraw consent

You have the right to withdraw your consent that has been given to us at any time pursuant to the methods and means prescribed by us, unless the nature of consent does not allow such withdrawal. The withdrawal of consent will not affect the lawfulness of the collection, use or disclosure of your personal data based on your consent before it was withdrawn.

You can review and change your consent to use or disclose your personal data for marketing purposes through channels as specified in No. 11 below or other channel prescribed by us in the future

4.8 Right to lodge a complaint

You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA.