We, SCB Asset Management Company Limited, care about the privacy of our customers, thus, we provide this privacy notice to inform our customers of our policy in relation to the collection, use and disclosure of personal data of individual (“you”) in accordance with the Personal Data Protection Act B.E. 2562 (“PDPA”), relevant laws and regulations. This privacy notice informs you of how we collect, use or disclose your personal data, what and why we collect, use or disclose your personal data, how long we hold it, who we disclose it to, your rights, what steps we will take to make sure your personal data stays private and secure, and how you can contact us.
This privacy notice applies to:
(1) Our customers
These include individuals who have no product or service holding with us, but we may need to collect, use or disclose your personal data (e.g. investors; anyone who makes a payment to or receives a payment from our customers; anyone that visits our website or our applications, branches or offices; guarantors or security providers; ultimate beneficial owner; directors or legal representatives of a company that uses our services; debtors of our customers; professional advisors, including our directors, investors, shareholders and their legal representatives, and anyone involved in other transactions with us or our customers).
Please note that some of the links on our platform may lead to third party’s platforms, and if you access these platforms, your personal data will then be processed under the third party’s policies. Make sure that you have read those privacy notices when accessing such platforms.
We only collect, use or disclose your personal data where it is necessary or there is a lawful basis for collecting, using or disclosing it. This includes where we collect, use or disclose your personal data based on the legitimate grounds of legal obligation, performance of contract made by you with us, our legitimate interests, performance under your consent and other lawful basis. Reasons for collecting, using or disclosing are provided below:
1.1. Our legal obligation
We are regulated by many laws, rules, regulations, and orders of any competent governmental, supervisory or regulatory authorities, and to fulfil our legal and regulatory requirements, it is necessary to collect, use or disclose your personal data for the following purposes, which include but not limited to:
a) Compliance with the PDPA and any amendment thereof;
b) Compliance with laws (e.g. Financial Institution Business Law, Securities and Exchange Laws, Anti-Money Laundering Laws, Prevention and Suppression of Financial Support to Terrorism and the Proliferation of Weapons of Mass Destruction Laws, and other laws to which we are subject both in Thailand and in other countries), including conducting identity verification, background checks and credit checks, Know Your Client/Customer Due Diligence (KYC/CDD) processes, other checks and screenings (including screening against publicly available government law enforcement agency and/or official sanctions lists), and ongoing monitoring that may be required under any applicable law (e.g. investment limits); and/or
c) Compliance with regulatory obligations and/or orders of authorized persons (e.g. orders by any court of competent jurisdiction or of governmental, supervisory or regulatory authorities or authorized officers).
1.2. Contract made by you with us
We will collect, use or disclose your personal data in accordance with the request and/or agreement made by you with us, for the following purposes, which include but not limited to:
a) process your request or intention prior to entering into an agreement, consider for approval in relation to the provision of products and/or services, processing your applications or requests for services or products, deliver our products and/or services to you, and deal with all matters relating to the products and/or services including any activities that if we do not proceed, then our operations or our services may be affected or may not be able to provide you with fair and ongoing services;
b) authenticate when entering into, doing or executing any transactions;
c) carry out your instructions respond to your enquiries, request or feedback, or to resolve your complaints;
d) provide online investment, mobile applications (e.g. SCB PVD Online, SCB MyProvident, PF Online and SCBAM Fund Click) and other online product platforms (e.g. Chatbot via Line official account of The Siam Commercial Bank Public Company Limited, ours and its financial business group companies);
e) track or record your transactions (e.g. transaction cost);
f) produce reports (e.g. transaction reports requested by you);
g) notify you with transaction alerts;
h) recover the money which you owe (e.g. when you have not paid for your loan debt and/or outstanding fees);
i) carry out account maintenance and operations relating to your accounts, including without limitation, processing your transactions, generating your confirmation letter, investment report, investment confirmation letter and account statement, and operating and closing your accounts;
j) carry out or make transactions and/or payments, such as processing payments or transactions, fulfilling transactions, conducting settlement, billing, processing and clearing activities, managing your relationship with us and administration of your account with us;
k) enforce our legal or contractual rights;
l) provide IT helpdesk and supports, create and maintain code and profile for you, manage your access to any systems to which we have granted you access, remove your accounts in the case where you are our independent investment planner;
m) provide investment products to you (including investment products of third parties that you may be interested) from time to time and deal with all matters relating to the investment products;
n) provide mutual fund management services (e.g. open account with bank custodian, make onshore and/or offshore investment and appoint a beneficiary);
o) provide private fund management services (e.g. fund set up, open deposit account and securities account, increase and decrease investment amount, enter into ISDA for and on behalf of private fund and proceed on related transaction with custodians);
p) open an omnibus account for buy, sell and switch unit-linked insurance products;
q) provide provident fund management services (e.g. fund set up, withholding tax submission to the Revenue Department and other ongoing registrar management); and/or
r) provide fund manager services for property fund, infrastructure fund and digital assets and provide trustee services for REITs.
1.3. Our legitimate interests
We rely on the basis of legitimate interests by considering our benefits or third party’s benefits with your fundamental rights in personal data which we will collect, use or disclose for the following purposes, which include but not limited to:
a) conduct our business operation and The Siam Commercial Bank Public Company Limited’s and its financial business group companies’ business operation (e.g. to audit, to conduct risk analysis and managements (e.g. investment risk), to monitor, prevent, detect and investigate fraud, money laundering, terrorism, misconduct, or other crimes, including but not limited to carrying out the creditworthiness checks of any persons related to our corporate customer, which may not be required by any governmental or regulatory authorities, and authenticate your identity to prevent such crimes);
b) conduct our relationship managements (e.g. to serve customers, to conduct customer survey, to handle complaints);
c) ensure security (e.g. to maintain CCTV records, to register, exchange identification card and/or take photo of visitors before entering into our building);
d) develop, test and improve our products and/or services, including systems to enhance our services standard and/or for the greatest benefits in fulfilling your needs;
e) record images and/or voices relating to the meetings, trainings, seminars, recreations or marketing activities and create public relations and marketing materials, such as publishing on newspaper, or posting on website and social media;
f) in case of our corporate customer, collect, use and disclose personal data of directors, authorized persons, witness to the power of attorney or attorneys;
g) ensure business continuity;
h) handle claims and disputes, including solving disputes, initiating, exercising or defending legal claims;
i) contact you prior to your entering into a contract with us;
j) evaluate suitability and qualifications, issuance of request for quotation and bidding, and execution of contract with you;
k) protect against security risks (e.g. monitoring network activity logs, detecting security incidents, conducting data security investigations, and otherwise protecting against malicious, deceptive, fraudulent, or illegal activity);
l) comply with applicable foreign laws;
m) manage our infrastructure (including data storage), internal control, and business operations and comply with our policies and procedures including those relating to risk control, security, audit, finance and accounting, systems and business continuity;
n) carry out research, planning and statistical analysis (e.g. on your investment limit and investment behavior, data analytics, assessments, surveys and reports on our products, services and your performance);
o) organize our promotional campaign or events, conferences, seminars, and company visits;
p) facilitate financial audits to be performed by an auditor, or receive legal advisory services from legal counsel appointed by you or us;
q) in the event of sale, transfer, merger, reorganization, or similar event, disclose or transfer your personal data to one or more third parties as part of that transaction;
r) maintain and update lists or directories of the customers (including your personal data), and keep contracts and associated documents in which you may be referred to;
s) comply with reasonable business requirements (e.g. management, training, auditing, reporting, control or risk management, statistical, trend analysis and planning or other related or similar activities, implementing business controls to enable our business to operate, and enabling us to identify and resolve issues in our IT systems, and keeping our systems secure, performing IT systems development, implementation, operation, test and maintenance);
t) undertake fraud prevention model development, underwriting model development, collection model development, and proxy income model development, and track propensity to approve model performance;
u) facilitate you and a financial institution that grants credit facility to you to receive and/or deliver your information relating to the provident fund’s contributions and credit facility in the case where you are member of the provident fund and apply for provident fund welfare loan with a financial institution approved by us;
v) apply for accidental insurance and/or life insurance for your benefit in the case where you are member of the provident fund which additionally provides accidental insurance policy and/or life insurance policy (as the case may be); and/or
w) produce reports (e.g. our internal reports).
1.4. Your consent
In certain cases, we may ask for your consent to collect, use or disclose your personal data to maximise your benefits and/or to enable us to provide services to fulfil your needs for the following purposes, which include but not limited to:
a) collect, use or disclose your sensitive personal data as necessary (e.g. to use your identification card photo (which contains your sensitive personal data, namely religion, blood type and/or race) biometric information (e.g. face recognition and voice recognition) and criminal record for verification of your identity before continuing the transaction, and Know Your Client (KYC) process and/or health and disability data (e.g. physical wellbeing and soundness of mind) for evaluating your suitability, vulnerability, and qualifications for investment);
b) collect and use your personal data and any other data to conduct research and analyze for the greatest benefits in developing products and services to truly fulfil your needs and/or to contact you for offering products, services and benefits exclusively suitable to you;
c) send or transfer your personal data overseas, which may have inadequate personal data protection standards (unless the PDPA specifies that we may rely on other legal basis or may proceed without obtaining consent);
d) when you are classified as a minor, incompetent or quasi-incompetent whose consent must be given by their parent, guardian or curator (as the case may be) (unless the PDPA specifies that we may proceed without obtaining consent); and/or
e) disclose your personal data and any other data to The Siam Commercial Bank Public Company Limited and its financial business group companies as shown on https://www.scb.co.th/en/about-us/affiliates-financial-business-group.html and our trusted business partners for the following purposes: (1) conducting research and analyzing your personal data and any other data for the greatest benefits in developing products and services to truly fulfil your needs; and (2) contacting you for offering products, services and benefits exclusively suitable to you.
1.5. Other lawful basis
Apart from the lawful basis which we mentioned earlier, we may collect, use or disclose your personal data based on the following lawful basis:
a) prepare historical documents or archives for the public interest, or for purposes relating to research or statistics;
b) prevent or suppress a danger to a person’s life, body or health; and/or
c) necessary to carry out a public task, or for exercising official authority.
If the personal data we collect from you is required to meet our legal obligations or to enter into an agreement with you, we may not be able to provide (or continue to provide) some or all of our products and services to you if you do not provide your personal data when requested.
The type of personal data, namely personal data and sensitive personal data, which we collect, use or disclose, varies on the scope of products and/or services that you may have used or had an interest in. The type of personal data shall include but not limited to:ted.
Examples of personal data
Identification and authentication details
Financial details and information about your relationship with us
Market research, marketing and sales information
Geographic information, information about your device and your software, and technical details
User login, subscription data, and profile details
Information concerning security
Sensitive personal data
Normally, we will collect your personal data directly from you (e.g. through our website (e.g. SCB PVD online, PF Online, SCBAM Website Contact Us, E-mail: email@example.com in Contact Us), mobile applications (e.g. SCBAM Fund Click, SCB Easy and SCB MyProvident), sales representatives, selling agents, relationship managers and SCBAM Client Relations), but sometimes we may get it indirectly from other sources (e.g. independent investment advisor, social media, third party’s online platforms, and other publicly available sources) and through The Siam Commercial Bank Public Company Limited (e.g. private banking relationship manager), our affiliates (e.g. SCB Securities Company Limited), service providers, business partners, official authorities (e.g. Department of Business Development, the Ministry of Commerce, Office of the Securities and Exchange Commission of Thailand, and the Stock Exchange of Thailand (FundConnext)), or third parties (e.g. your representative, employer, sponsor and third parties that have roles in delivering services to you or someone acting on their behalf may provide us with information about you, third-party underwriters, third-party agents, third-party registrar, third-party custodians (e.g. custodian of selling agent in case of unit-linked insurance products), sub-custodians, and brokers), in such case we will ensure the compliance with the PDPA.
The PDPA aims to give you more control of your personal data. You can exercise your rights under the PDPA upon the effectiveness of the provisions in relation to rights of data subjects, details are as follows:
4.1 Right to access and obtain copy
You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.
4.2 Right to rectification
You have the right to rectify your inaccurate personal data and to update your incomplete personal data.
4.3 Right to erasure
You have the right to request us to delete, destroy or anonymise your personal data, unless there are certain circumstances where we have the legal grounds to reject your request.
4.4 Right to restrict
You have the right to request us to restrict the use of your personal data under certain circumstances (e.g. when we are pending examination process in accordance with your request to rectify your personal data or to object the collection, use or disclosure of your personal data, or you request to restrict the use of personal data instead of the deletion or destruction of personal data which is no longer necessary but you ask us to restrict it instead as you have necessity to retain it for the purposes of establishment, compliance, exercise or defense of legal claims).
4.5 Right to object
You have the right to object the collection, use or disclosure of your personal data in case we proceed with legitimate interests basis or for the purpose of direct marketing, or for the purpose of scientific, historical or statistic research, unless we have legitimate grounds to reject your request (e.g. we have compelling legitimate ground to collect, use or disclose your personal data, or the collection, use or disclosure of your personal data is carried out for the establishment, compliance, or exercise legal claims, or for the reason of our public interests).
4.6 Right to data portability
You have the right to receive your personal data in case we can arrange such personal data to be in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means. Also, you have the right to request us to send or transfer your personal data to third party, or to receive your personal data which we sent or transferred to third party, unless it is impossible to do so because of the technical circumstances, or we are entitled to legally reject your request.
4.7 Right to withdraw consent
You have the right to withdraw your consent that has been given to us at any time pursuant to the methods and means prescribed by us, unless the nature of consent does not allow such withdrawal. The withdrawal of consent will not affect the lawfulness of the collection, use or disclosure of your personal data based on your consent before it was withdrawn.
4.8 Right to lodge a complaint
You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA.
We may disclose your personal data to the following parties under the provisions of the PDPA:
a) our parent company, financial business group companies (e.g. SCB Abacus Company Limited for conducting data analytics, and SCB Securities Company Limited for rendering investment advisory services), business partners (including payment recipients, beneficiaries, account nominees, intermediaries (such as third-party securities companies, or asset management companies), banks, brokers, underwriters, financial advisor, registrar, custodians, sub-custodian, custodians of selling agent, REIT manager, correspondents, agents, co-brand business partners, market counterparties, issuers of products, or global trade repositories) and/or other persons that we have the legal relationship, including our directors, executives, employees, staffs, contractors, representatives, advisors and/or such persons’ directors, executives, employees, staffs, contractors, representatives, advisors;
b) governmental authorities and/or supervisory or regulatory authorities (e.g. the Bank of Thailand, Office of the Securities and Exchange Commission of Thailand, Ministry of Digital Economy and Society, Anti-Money Laundering Office, Thai Revenue Department, the Stock Exchange of Thailand, Thailand Futures Exchange, Thailand Securities Depository, Thailand Clearing House, and court);
c) suppliers, agents and other entities (e.g. professional associations to which we are member, external auditors, depositories, document warehouses, overseas financial institutions and clearing houses) where the disclosure of your personal data has a specific purpose and under lawful basis, as well as appropriate security measures;
d) any relevant persons as a result of activities relating to selling rights of claims and/or assets, restructuring or acquisition of any of our entities, where we may transfer their rights to; any persons with whom we are required to share data for a proposed sale, reorganisation, transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets held by our business;
e) other banks, financial institutions and third parties where required by law to help recover funds that have entered your account due to misdirected payment(s) by such third parties or trace funds where you are a victim of suspected financial crime, or where suspect funds have entered your account as a result of financial crime;
f) debt collection agencies, lawyers, credit bureau, fraud prevention agencies, courts, authorities or any persons whom we are required or permitted by laws, regulations, or orders to share personal data;
g) third parties providing services to us (e.g. settrade.com, IT service providers (e.g. Google Cloud Platform (GCP) and MSCI Limited and outsource or vendor who provides operational system test and development services), document delivery service providers, customer (e.g. Thailand Post, TKS and G4S) satisfaction survey service (e.g. Nielson, Little Big Links and PCC International Co., Ltd.), physical document storage service (e.g. SST), printing services, market analysis and benchmarking, including but not limited to agents and subcontractors acting on our behalf, the companies which print and deliver documents);
h) social media service providers (in a secure format) or other third-party advertisers so they can display relevant messages to you and others on our behalf about our products and/or services. Third-party advertisers may also use information about your previous online activities to tailor adverts to you;
i) third-party security providers;
j) other persons that provide you with benefits or services associated with your products or services, e.g. insurance company (for provident fund services); and/or
k) your attorney, sub-attorney, authorized persons or legal representatives who have lawfully authorized power.
The nature of the modern investment business is global and under certain circumstances it is necessary for us to send or transfer your personal data internationally. When sending or transferring your personal data, we will always exercise our best effort to have your personal data transferred to our reliable business partners, service providers or other recipients by the safest method in order to maintain and protect the security of your personal data, which includes the following circumstances:
a) comply with a legal obligation;
b) inform you the inadequate personal data protection standards of the destination country and obtain your consent;
c) perform the agreement made by you with us or your request before entering into an agreement;
d) comply with an agreement between us and other parties for your own interest;
e) prevent or suppress a danger to your or other persons’ life, body or health and you are incapable of giving consent at such time; or
f) carry out activities relating to the substantial public interest.
We will maintain and keep your personal data while you are our customer and once you have ended the relationship with us (e.g. after you closed your account with us, or following a transaction with us, or in case of your application to use our services is disapproved, or you terminated the services provided by us), we will only keep your personal data for a period of time that is appropriate and necessary for each type of personal data and for the purposes as specified by the PDPA.
The period we keep your personal data will be linked to the prescription period or the period under the relevant laws and regulations (e.g. Financial Institution Business Laws, Securities and Exchange Laws, Anti-Money Laundering Laws, Prevention and Suppression of Financial Support to Terrorism and the Proliferation of Weapons of Mass Destruction Laws, Accounting Law, Tax Laws, Labour Laws and other laws to which we are subject both in Thailand and in other countries). In addition, we may need to retain records of CCTV surveillance in our head office, our branches and/or voice records of SCBAM Client Relations to prevent fraud and to ensure security, including investigating suspicious transactions which you or related persons may inform us.
We are entitled to continue collecting and using your personal data which has previously been collected by us before the effectiveness of the PDPA in relation to the collection, use and disclosure of personal data, in accordance with the original purposes. If you do not wish us to continue collecting and using your personal data, you may notify us to withdraw your consent at any time.
We endeavour to ensure the security of your personal data through our internal security measures and strict policy enforcement. The measures extend from data encryption to access control restriction. We also require our staff and third-party contractors to follow our applicable privacy standards and policies and to exercise due care and measures when using, sending or transferring your personal data.
If you have any questions or would like more details about our privacy notice or would like to exercise your rights, please contact us through SCBAM Client Relations Tel. 02-777-7777 press 0 then 6 during the Company’s office hours.
Alternatively, you can contact our Data Protection Officer by writing to E-mail: firstname.lastname@example.org or contact our head office located at SCB Park Plaza Bldg., Tower 1, 7th-8th Floor, 18 Rutchadapisek Road, Chatuchak, Chatuchak, Bangkok 10900.
We may change or update this privacy notice from time to time and we will inform the updated privacy notice at our website www.scbam.com.
Version January 2021