Privacy Policy

Privacy Policy

Orico Auto Leasing (Thailand) Ltd. (“The Company”) highly respects your rights and values your personal data. For the purposes of providing services and developing various services, the company therefore realizes the responsibility of the company in collecting, using, processing and/or disclosing your personal data according to the purposes which the company has obtained permission from you. As the Data Controller, the company is committed to protecting personal data that is any information, which enables the identification of you as an individual whether directly or indirectly.

Therefore, in order to understand the processes, the guidelines and the purposes of the company in collecting, using, processing and/or disclosing personal data. The company thus has established a privacy policy (“Policy”) in accordance with the Law on Personal Data Protection and related laws as follows:

1. Definition

Unless otherwise specified in this policy, the following words have the following meanings:

“You”                    means a natural person who owns the personal data, for example, customers, hire-purchase customers, loan applicants, guarantors, or applicants for other services of the company, or any other persons in establishing relationships with the company and the company partners including those selling products/ services to the company.

“Personal Data” means any information pertaining to a person, which enables the identification of such person, whether directly or indirectly, but not including the information of the deceased persons in particular.

2. Scope of this Policy

Please be informed that

2.1 This Policy will explain how the company manages and protects your personal data under the Personal Data Protection Act B.E. 2562 and/or other related laws.

2.2 The terms and conditions under this policy are governed by and construed in accordance   with the Thai law of the Kingdom of Thailand. If there are any disputes related, it shall be under the jurisdiction of the Thai court.

2.3  The company has no policy to collect personal data for minors under 20 years old.

2.4  This policy has been prepared in 2 languages which are Thai and English. In case of conflicts or different interpretation of two languages, use the texts in Thai version primarily.

3. Personal data collection

The company collects your personal data and sensitive information such as

3.1    Your personal data is collected by the company such as First name, Middle Name (if any), Surname, Number of identification card or other identification cards, Status, Contact number, Date of birth. Gender, House registration address, Office address, Email address, Credit card number, Bank account number, Financial information and Health information.

3.2  In the event that you visit the company’s website, the website will collect data such as IP address, Browser types, History of website visited and Access time.

3.3  The company will collect, use and process your personal data provided via the company website which includes First name, Middle name (if any), Surname, Contact number. https://oalt.co.th/contact-us/

3.4  Documents that you deliver to the company such as a copy of identification card, a copy of house registration, salary certificate, and other documents identifying your personal data.   

3.5  Information that the company has received from you when you fill out the information in the hire-purchase request form, guarantor form, or other forms in order to apply for a car loan with the company such as First name, Middle name (if any), Surname, Number of identification card or other identification cards, Status, Contact number, Date of birth, Gender, Postal address, Email address, Financial information and Health information and including First name and Surname of the reference persons and personal data of the spouse (if any).

3.6 Information about your transaction with the company or others such as insurance policy information, insurance coverage information, premium, and payment history which includes bank account number or other banking or payment information including the date and time of payment.

3.7  Personal data that the company has received from you when you fill out your personal data on the company’s form and documents you deliver to the company for being a partner with the company such as First name, Middle name (if any), Surname, Number of identification card or other identification cards, Contact number, Date of birth, Gender, Address, Email Address, and Bank account number.

3.8 Personal data that the company requests from you directly including information communicated with you.

3.9  Recording your correspondence with the company or recording a conversation when you contact the company.

3.10 Information that you provided to the company when you have requested additional information about the company’s services or let the company to contact you back.

3.11 Information in the documents that you as a seller of products/ services deliver documents to the company such as a copy of identification card or a copy of another identification card and other documents identifying your personal data.

Remarks: Please be informed that if you have given explicit consent, the company may collect your personal data from other reliable sources. The company may also need to sparingly request other personal data such as race, criminal history, financial history, health information, genetic information, biological information, etc. These will be used for processing according to the purposes in [Article 4. Purposes of the collection, use, processing, and disclosure of personal data].

4. Purposes of the collection, use, processing, and disclosure of personal data

4.1 The company collects and processes personal data for the purpose of internal management of the company as follows:

4.1.1 For direct marketing such as contacting via email, text messaging, or by phone.

4.1.2 To use in the development, testing and improving the company’s website/portals or systems or other processes either existing or new in order to make services better. In terms of new information systems and processes, the company may use information about you to test those new information systems and processes since the simulation data cannot be fully tested for the operation of the new information systems.

4.1.3 To use in education, statistical and analytical reports.

4.1.4 To check for compliance with internal policies and procedures.

4.1.5 To manage communication and other systems which the company uses to contact. (including internal contact database)

4.1.6 To investigate or respond to incidents or complaints.

4.1.7 To comply with legal requirements.

4.1.8 To prevent and investigate acts that breach the applicable law.

4.2 The company will use the collected personal data according to each Data Subject as the following purposes.

4.2.1  [Data Subject as Customer/ Hire-purchase customer]

  1. For the purpose of requesting for a car loan or requesting a loan with the company.
  2. In order to verify the identity and address of the loan applicant during the loan request.
  3. For undertaking credit analysis and financial reliability.
  4. To use in the car hire-purchase contract or other loan contracts with the company.
  5. To use in contacting for presenting products and other services of the company such as  Ocar Ocash product, product updates, upcoming promotion updates.
  6. To use in proceeding with car insurance and loan protection insurance.
  7. To use in contacting insurance companies, such as following up an insurance policy, compensation.
  8. To use in contacting life insurance companies, such as following up a life insurance policy, compensation.
  9. For debt collection.
  10. (10)To deliver relevant documents such as invoices, receipts, tax invoices, insurance notification letter, vehicle act, annual vehicle tax, or other documents related to car hire-purchase transactions or other loan contracts.
  11. To transfer or receive the ownership of a vehicle and use the data to operate other related vehicle registrations.
  12. (12)To enable the company to perform duties and enable the company to enforce the contractual rights in case of breach of contract.
  13. (13)In order to respond to your enquiries or complaints and to resolve any disputes such as product information, overdue notification or change of address.
  14. (14)To be the information in receiving payments for the company.
  15. (15)To provide identity verification prior to providing information about the Data Subject in such areas as collection, vehicle registration, insurance/ loan protection insurance, finance, or address confirmation.

4.2.2  [Data Subject as Reference person/ Spouse of customer/ Spouse of hire-purchase customer]

In order to be the reference information for applying for a loan and use the information in contacting/ answering questions.

4.2.3  [Data Subject as Beneficiary of customer/ hire-purchase customer]

To use in contacting beneficiaries according to the insurance policy or life insurance policy.

4.2.4 [Data Subject as Guarantor of customer/ hire-purchase customer]

In order to be a guarantor for used car hire-purchase customers and/or a guarantor for loan applicants with the company.

4.2.5  [Data Subject as Partner of the company]

  1. To be used as references for checking the information in requesting to be a partner with the company.
  2. For promotional activities.
  3. To proceed the payments regarding car hire-purchase transactions with the company.

4.2.6  [Data Subject as seller of products/services to the company]

(1) To confirm your identity before the company makes payments and as a proof of payment.

4.3 The personal data processing of the company adheres to the abovementioned purposes and

(1) To promote safety and protect people, places, systems and asset.

(2) To check in order to comply with internal policies and procedures.

(3) To manage communication and other systems that the company uses (including internal contact database).

(4) To investigate or respond to incidents and complaints.

5. Sharing and disclosure of personal data

The company is highly aware and pays attention to the disclosure of your data with details as follow:

5.1 The company will absolutely not disclose your personal data to others or external organizations to seek profit from sales or distribute your personal data. Your personal data will be kept confidential.

5.2 In the event that you have given consent to transfer, share and disclose your personal data, the company may share your personal data to third parties who can be surely identified as follows:

5.2.1 Related group of companies: The company may share your personal data for business purposes within our group of companies which are the main shareholders: Orient Corporation, Orico Management (Thailand) Co., Ltd.

5.2.2 Outsourcing companies/ contractors/ external service providers/ third parties: In the event that the company has hired outsourcing companies/ contract parties/ external service providers/ third parties to take any necessary actions, use and/or collect your personal data, the company has required those outsourcing companies/ contract parties/ external service providers/ third parties to protect the privacy of your personal data and prohibit to use your personal data for any purposes other than for the purposes specified in the agreements as follows:

(1) The company will share personal data with third parties who provide services in verifying identification and address of loan applicants during the loan request.

(2) Contract companies that are life insurance brokers, general insurance brokers and life insurance companies. The company will forward and share your personal data with licensed brokers and insurers. The disclosure of such information is for you to be able to conduct transactions and/or use desired services.

(3) The company will share your personal data with outsourcing companies which provide services in vehicle ownership transfer and other related vehicle registration works.

(4) The company will share your personal data with outsourcing companies which provide debt collection services.

(5) The company will share your personal data with external consulting companies which provide legal advice and acting on behalf of the company in performing duties and can enforce contractual rights in case of breach of contract by the hire-purchase customer.

(6) The company will disclose personal data to commercial banks that the company conducts financial transaction with in order to help the process of receiving payments, making payments, refunding, confirming the identity of account holder, checking customer account and account movement and giving consent to the company to deduct installments via customer accounts.

(7) The company will share personal data to third parties which provide services regarding customer referrals to the company and/or account closing services for customers who request a loan with the company.

(8) The company will disclose data to employees authorized by the company, auditors or external auditors to carry out activities related to auditing, tax consulting. This includes lawyers and other area expert advisers that provide advice and assist the company to operate legally and efficiently, including any disputes that the company may be involved in.

(9) The company will disclose personal data to third parties who provide services in application/ function, data processing, or information technology services, the rental of operating system software within the company including data backup, data security and collection. The server that supports and facilitates works is located at the secure data center. However, the company may share personal data so that third parties can assist us with data analytical insights.

(10) The company may share personal data with expert contractors who assist us with marketing and advertising services via Facebook or Google or other advertising tools related to the company’s products and services.

(11) The company will share your personal data with business partners and contractors when there is an event. Third party service providers will assist us in the operation and management of such activities by sharing your personal data to be used in case related to those activities.

(12) Other organizations which the law required the company to share data are as follows:

(i)    Complying with judicial orders, administrative agencies and government agencies, when requested to be used in the trial, or other purposes as required by law.

(ii)  Disclosure of data to National Credit Bureau Co., Ltd which the company is a member.

(iii)  Disclosure of data complied with the law for investigation or legal action.

(iv)  Disclosure of data complied with the law or the orders of government agencies or regulatory agencies.

(v)  Disclosure of data to third parties which the company has obtained your consent to disclose your data to that person.

Remarks: However, the company has no duties to inspect, control or support any privacy practices of third parties in anyway. This privacy policy will apply to personal data that the company collects through the company’s employees, services, and/or in the connection with the operations of the company only, which will not apply to third parties and third party service providers.

6. Data retention period

The company will keep personal data of customers for a maximum of 10 years after the end of contractual transactions, will keep personal data of business partners for a maximum of 10 years after the end of services, and will keep personal data of sellers of products/ services for 5 years from the last day of that fiscal year.

However, you have the rights to notify the company if you wish to erase your data at any time. Please contact the company as the detailed in [Article 11. Contact the company].

7. Transferring personal data to foreign countries

In the event that you have given consent to transfer of personal data to foreign countries, the company may send your data to the main shareholder; Orient Corporation in Japan which the identity can definitely be defined and there is a privacy policy in accordance with the same standard as the company’s personal data policy.

8. Personal data security

8.1 The company provides appropriate security to assure you that your personal data is protected and sufficiently secured. The company uses appropriate security measures to prevent unauthorized access to personal data, collection, disclosure, copying, modification, leakage, loss, damage and/or change of personal data. However, the company will not be responsible if external persons use your personal data without permission due to the causes that the company cannot control.

8.2 In case of personal data breach, the company without delay will inform the office of the personal data protection commission within 72 hours, unless the breach is no risk of affecting rights and freedom of person.

9. Rights of personal Data Subjects

9.1 The right to request access and to obtain a copy of the personal data related to you.

You have the right to request the affirmation or confirmation that the company has processed your personal data or not. In some cases, you may be able to access your personal data and some related data processing and have the right to request a copy of your personal data in which the company has collected including details about how the company uses that data.

9.2 The right to request to send or transfer personal data to other persons automatically.

In some situations, you have the right to request the company to transfer your personal data to other persons as per your request.

Remarks: The company will not be responsible to the security of the data which is transferred to other persons.

9.3 The right to edit your personal data

If your personal data collected by the company is inaccurate or not up to date, you can request to update or change your personal data. 

9.4 The right to request to erase personal data

You have the right to request the company to erase your personal data at any time. However, the company will assess your request whether your request should be treated or not under any legal rights or contractual obligations that make the company needs to keep your personal data according to the situation in accordance with the law. However, once the company considers that the request to erase your data must be treated, the company will immediately comply with the request. However, once your data has been erased as per your request, the company will not be able to provide services any longer.

The company will erase your personal data in the event that personal data is no longer necessary for the purposes of collection or processing as detailed in [Article 6. Data retention period], including in case of withdrawing consent or unlawful data processing.

9.5 The right to request to suspend data processing

In certain situation, you have the right to restrict our data processing. In either case, if the following conditions appear:

9.5.1 The accuracy of your data is disputed.

9.5.2 The processing of your data is illegal.

9.5.3 Your data is no longer necessary for the company’s data processing.

Remarks: In the event that the law requires data processing of the above data, the company may use the data again for filing a lawsuit or litigation or for other protection.

9.6 The right to object data processing.

The company legally processes your personal data according to the company rights or as detailed in [Article 4. Purposes of the collection, use, processing, and disclosure of personal data] and you have the right to object processing of your personal data at any time.

In order to protect your privacy and security, the company will take appropriate steps by verifying your identity prior to allowing you to access your personal data. The company will try to conduct an investigation immediately and respond to your requests as required by law. If you wish to exercise any of the above rights, please contact the company as detailed in [Article 11. Contact the company].

10. Change and revision to this privacy policy

When there are significant changes, the company may review this policy in order to be suitable and in line with changing circumstances. The company may change terms and conditions of this policy from time to time. If the company has significantly changed the contents regarding the use of your personal data, the company will display the change details on the company’s website and/or announce in writing.

11. Contact the company

If you wish to exercise any of the rights specified in [Article 9. Rights of personal Data Subjects] or have any questions, suggestions, enquiries about this policy or need more information about how the company protects your personal data, you can contact the company as follows.

Contact the company

Orico Auto Leasing (Thailand) Ltd.

Headquarter: 689 Bhiraj Tower at Emquartier 17th Floor., Unit 1702-1703, 1705-1707

Sukhumvit Rd., North Klongton, Vadhana, Bangkok 10110

Contact number: 02-026-5844  (08:30 AM – 17:30PM on Monday – Friday)

12. Enforcement of the privacy policy

This privacy policy will apply to all of your personal data that the company collects, uses, processes, shares and/or discloses the personal data. The personal data may be your personal data that the company collected in the past and/or your personal data that you have given consent the company to collect at present, and your personal data that will be collected in the future. This also includes your personal data that the company already collected (if any) which may be obtained from other sources.

In the event that the law on personal data protection and/or other relevant laws have changed or there are rules, codes, proclamations, and/or any regulations that may affect the enforcement of this policy, if appears that this policy is contrary to or conflicting with the law, and/or rules, codes, proclamations, and/or any regulations that come into force later, the use of the privacy policy in that respect shall be in accordance with the content of the law and/or rules, codes, proclamations and/or any regulations that come out later and are in force at that time.

13. Effective date

This privacy policy shall come into effect from 20 May 2020 onwards.