Introduction
Vincent International Co., Ltd. (the “Company”) recognizes the importance of personal data protection. The Company has therefore established this Personal Data Protection Policy so that employees within the organization are aware of, and comply with, matters relating to personal data protection. This Policy describes how the Company handles personal data, such as its collection, retention, use, and disclosure, as well as the various rights of data subjects, among other matters. It is also intended to inform data subjects of the Company’s personal data protection policy. The Company hereby announces this Policy as follows:
1. Personal Data
1.1 Definitions
“Company” means Vincent International Co., Ltd.
“Personal Data” means any information relating to a natural person that enables the identification of that natural person, whether directly or indirectly, but excluding the personal data of deceased persons.
“Sensitive Personal Data” means personal data relating to race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data (e.g., fingerprint scans, facial scans), or any other data that similarly affects the data subject, as prescribed by the Personal Data Protection Committee.
“Processing” means any act or operation performed on personal data, including collection, use, or disclosure by transmission or dissemination of the data through various means.
“Data Subject” means a natural person who owns the personal data that the Company collects, uses, or discloses, consisting of:
(1) Individual customers
(2) Individual trading partners
(3) Directors, executives, advisors, partners, shareholders, attorneys-in-fact, agents, and representatives
(4) Employees, staff, and workers
(5) Visitors to websites, online platforms, or other communication channels controlled by the Company
(6) Other persons whose personal data the Company collects, such as job applicants, employees’ family members, beneficiaries under insurance policies, and employment guarantors
“Data Controller” means a person or juristic person who has the authority to make decisions regarding the collection, use, or disclosure of personal data.
“Data Processor” means a person or juristic person who collects, uses, or discloses personal data pursuant to the orders of, or on behalf of, a data controller. A person or juristic person who carries out such activities is not a data controller.
1.2 Personal Data Collected
The Company may collect the following personal data about you:
General Personal Data
1. Personal information, including first name and surname, date of birth, place of birth, marital status, information stated on the national identification card and passport, a copy of the national identification card, or the national identification number.
2. Contact information, including address, telephone number, LINE ID, social media contact channels, workplace, job position, and department or organization.
3. Payment information, such as bank account details, credit/debit card details, or online banking details.
4. Service information, such as procedure information, medical appointment information, and CCTV footage.
5. Statistical information, such as the number of visits to the Company’s website or application.
6. Health information, biometric data (such as facial simulation images), genetic data, health-related reports, medication use, drug allergies, food allergies, and diagnoses.
7. Information relating to the use of electronic systems, including email, IP address, browser type, cookies, and chat history in various applications.
8. Information that you provide when you contact the Company or participate in any activity with the Company, etc.
Sensitive Personal Data
The Company collects your personal data, namely facial scan images, blood type, and religion, for the purpose of providing the Company’s services. The Company will request your explicit consent directly, unless otherwise provided by law.
2. Purposes of Collecting or Using Personal Data
The Company collects, uses, and discloses your personal data for the following purposes:
1. For the purpose of providing or receiving medical services, including follow-up on services provided and after-sales services.
2. For financial, accounting, and tax transactions.
3. Study or research.
4. For the purpose of creating databases for analyzing and offering any services or products of the Company and its group companies, or of persons who are distributors or agents of, or are otherwise related to, the Company.
5. For the purpose of improving the quality of operations, services, and activities relating to the Company’s business.
6. For analyzing and monitoring the use of services through the website, and for retrospective review in the event of usage problems.
7. For participation in the Company’s various activities.
8. For the purposes of access control; prevention and suppression of danger to the life, body, or health of you or other persons; control and prevention of communicable diseases; and maintaining security around the building, within the building, and on the Company’s premises.
9. For marketing and advertising of services/products, for which the Company will first request your explicit consent.
10. To comply with laws or regulations applicable to the Company, both now and in the future.
The personal data that the Company collects for the above purposes is necessary for the performance of contracts or for compliance with applicable laws. If you do not provide such necessary personal data, this may constitute a violation of law, or the Company may be unable to administer or manage contracts or facilitate various arrangements for you. If the purposes of collecting personal data subsequently change, the Company will notify you and take any other actions required by law, including keeping a record of the amendments as evidence.
3. Collection of Personal Data
When collecting personal data directly from data subjects, and when using and disclosing personal data, the Company will request consent from the data subject before or at the time of collection if the law requires consent to be obtained. The Company will process personal data only to the extent necessary for the purposes it has explicitly specified.
However, the Company may collect personal data from sources other than the data subject, such as various public media, only where necessary and by methods prescribed by law.
4. Sources of Personal Data
1. Personal data obtained directly from job applicants and employees who have been employed, such as job applications and personal histories.
2. Personal data from trading partners, customers, contractors, or visitors, such as quotations, names, telephone numbers, and email addresses.
3. Personal data from external agencies, such as government agencies, hospitals, financial institutions, agents, brokers, and other intermediaries.
5. Personal Data Retention Period
The Company will retain your personal data for as long as necessary for the purposes of collecting, using, and disclosing personal data specified in this notice. The criteria used to determine the retention period include the period during which the Company maintains a relationship with you as a customer of the Company. The Company may continue to retain the data for the period necessary to comply with the law or within the legal statute of limitations; for the establishment of legal claims, compliance with the law, the exercise of legal claims, or the defense of legal claims; or for other reasons in accordance with the Company’s internal policies and requirements.
Where the retention period cannot be clearly specified, the Company will retain the data for a period that may reasonably be expected under the standards of collection (e.g., the maximum general statute of limitations of 10 years).
6. Disclosure of Personal Data to External Parties and Overseas
The Company will not disclose the personal data of data subjects to any person without consent and will disclose such data only for the purposes that have been notified. Nevertheless, for the benefit of the Company’s operations and the provision of services to data subjects, the Company may need to disclose the personal data of data subjects to its affiliated companies or to other persons in Thailand and abroad, such as service providers that must carry out operations involving personal data. When disclosing personal data to such persons, the Company will require them to keep the personal data confidential and not to use it for any purpose beyond the scope specified by the Company.
The Company may disclose your personal data to the following persons:
1. Business partners
2. Agents, service providers, or trading partners that provide services to us or act on our behalf in any manner, such as information technology service providers or data processors, both in Thailand and abroad
3. Government agencies or officials exercising their powers and duties under the law
The Company may disclose the personal data of data subjects under criteria prescribed by law, such as disclosure to government authorities, state agencies, and regulatory authorities. This includes cases where disclosure is requested under legal authority, such as a request for information for legal action or prosecution, or a request from private entities or other third parties involved in legal proceedings.
Links to Third-Party Websites/Applications
Where our website and applications can link to third-party websites or applications, please note that this Policy does not extend to those third-party websites or applications. Accordingly, the collection, use, or disclosure of your personal data in any manner by such third parties is beyond our knowledge and control, and we are not involved in, and shall not be liable for, any actions of such third parties.
You should therefore review the personal data protection policy of the relevant website or application before visiting it or using any of its services.
7. Personal Data Security Measures
The Company will establish various measures, including measures to maintain the security of personal data, in accordance with the laws, regulations, criteria, rules, and guidelines on personal data protection, for customers, service users, employees, personnel, and other persons who have a legal relationship with the Company. The Company will also support and encourage employees to have knowledge and understanding of, and awareness of, their duties and responsibilities regarding personal data used in their work or in supporting the work of other units within the organization. The collection, use, processing, and disclosure of personal data must strictly comply with the personal data protection policies, rules, and guidelines established by the Company, so that the Company can comply with this Policy and the Personal Data Protection Act correctly and effectively.
8. Rights of the Data Subject
8.1 The right to withdraw consent to the processing of personal data for which consent has been given. The withdrawal of consent shall not affect the collection, use, or disclosure of personal data for which consent has already been given.
8.2 The right to access and obtain a copy of personal data, including the right to request disclosure of how personal data for which consent was not given was obtained.
8.3 The right to receive personal data, where the data has been made available in a format that is generally usable by automated tools or devices.
8.4 The right to object to the collection, use, or disclosure of personal data, except where the Company has lawful grounds to refuse the request.
8.5 The right to rectify personal data. The data subject may request the Company to correct the data so that the personal data is accurate, complete, and not misleading.
8.6 The right to have personal data erased or destroyed, or anonymized so that it cannot identify the data subject, as prescribed by law.
8.7 The right to restrict the use of personal data as prescribed by law.
8.8 The right to lodge a complaint regarding the use of personal data.
Data subjects may exercise the above rights by submitting a request to the Company in writing or by email, using the form prescribed by the Company, through the “Company Contact Channels” below. The Company will consider the request and notify the data subject of the outcome within 30 days from the date of receipt of the request. However, the Company may deny the data subject’s rights in cases provided by law.
9. Review and Amendment of the Personal Data Protection Policy
The Company may update or amend this Policy from time to time to keep it consistent with legal requirements, changes in the Company’s operations, and suggestions and comments from various agencies. The Company will clearly announce any such changes.
10. Company Contact Channels
10.1 Data Controller
Vincent International Co., Ltd.
Exchange Tower, Unit 3W/F, 3rd Floor, 388 Sukhumvit Road, Khlong Toei Subdistrict, Khlong Toei District, Bangkok 10110
Telephone: 081 208 5552
Email: [email protected]
Company websites: https://vincent.clinic, https://vincentsurgery.com, https://myvincentapp.com, https://vincentskin.com
10.2 Data Protection Officer
นายสันติภาพ หอมอบ, IA Manager, Vincent International Co., Ltd.
Exchange Tower, Unit 3W/F, 3rd Floor, 388 Sukhumvit Road, Khlong Toei Subdistrict, Khlong Toei District, Bangkok 10110
Telephone: 081 208 5552
Email: [email protected]
Company websites: https://vincent.clinic, https://vincentsurgery.com, https://myvincentapp.com, https://vincentskin.com