1. Introduction
AIM Bangkok Business & Legal Solutions (Thailand) Co., Ltd. (“AIM Bangkok,” “we,” “us,” or “our”) respects the privacy of all individuals who interact with us. This Privacy Policy outlines how we collect, use, disclose, store, and protect personal data, ensuring compliance with the Personal Data Protection Act B.E. 2562 (PDPA) and international standards.
2. Applicability of This Privacy Policy
This Privacy Policy applies to the collection and processing of personal data by AIM Bangkok involving all individuals who interact with us directly or through third parties acting on our behalf (“Data Processors”). These individuals include, but are not limited to:
- Clients: Individuals who engage our services for personal or corporate legal matters.
- Corporate Representatives: Directors, officers, authorized representatives, employees, and agents of client companies.
- Prospective Clients: Individuals making inquiries, seeking information, or attending our events and seminars.
- Employees and Job Candidates: Current employees, former employees, job applicants, and individuals involved in recruitment activities.
- Vendors and Service Providers: Individuals or representatives of partner firms, vendors, and external service providers.
- Website and Office Visitors: Users of our online platforms and individuals visiting our premises.
- Regulatory and Professional Stakeholders: Individuals such as regulators, trade association members, and professional contacts engaging with us in a business context.
- Associated Individuals: Family members of clients or employees, where data processing is necessary for service provision or employment-related purposes.
3. Collection of Personal Data
We may collect personal data through:
- Direct Interactions: Information provided by you or your representatives via our website, portals, email communications, phone calls, or in-person interactions.
- Third-Party Sources: Information obtained from reliable public sources, government bodies, or professional institutions.
4. Types of Personal Data Collected
The types of personal data we collect depend on the nature of our relationship with you and the purposes for which the data is processed. Categories of personal data we may collect include:
- Basic Personal Information: Full name, date of birth, gender, contact details (phone number, email address), residential or business address, title, position, and identification numbers (e.g., national ID, passport, work permit).
- Employment Data: Job history, current and past job titles, employment status, performance reviews, educational background, training records, certifications, and professional affiliations.
- Financial Information: Bank account details, payment and transaction records, income information, and other financial data necessary for billing and service purposes.
- Technical Data: IP address, device identifiers, browser type, operating system, and website usage data obtained through cookies and similar technologies.
- Communication Records: Correspondence with us, including emails, phone conversations, messages, feedback, and participation records in events, seminars, or training sessions.
- Biometric Data: Fingerprints, facial recognition, and other biometric identifiers, collected only with explicit consent or as permitted by law.
- Sensitive Personal Data: Information related to health, disability status, union membership, criminal records, racial or ethnic origin, religious beliefs, or other sensitive information as defined under the PDPA. We process such data only with explicit consent or when legally required.
- Data Related to Minors and Incapacitated Persons: Collected only when necessary, with appropriate consent from parents, guardians, or legal representatives, as mandated by law.
- Marketing and Interaction Data: Information gathered from interactions during marketing activities, event participation, and subscription to newsletters or updates.
- Visual and Audio Data: Photographs, video recordings (e.g., CCTV footage on our premises), and audio recordings as needed for security or operational purposes.
- Location Data: Collected when using services requiring or involving location-based information.
This list is not exhaustive and may include other types of personal data as necessary, depending on the context of your interaction with us and the services we provide.
5. Purpose of Personal Data Processing
We process personal data to fulfill our commitments, comply with legal requirements, and support legitimate business interests. The purposes for collecting and processing personal data include, but are not limited to:
5.1 Legal and Consulting Services
- Service Provision: Delivering comprehensive legal advice, preparing and reviewing contracts and legal documents, representing clients in legal disputes, and conducting thorough legal research.
- Due Diligence and Compliance: Conducting conflict-of-interest checks, anti-money laundering (AML) screenings, sanction compliance reviews, and fraud detection.
- Billing and Payments: Managing client accounts, processing payments, conducting tax reporting, and handling collections.
- Client Communications: Engaging with clients for case updates, responding to inquiries, and facilitating legal and consulting services.
5.2 Business and Administrative Operations
- Profile Creation: Establishing and maintaining internal records of clients, vendors, and employees to support business operations.
- Employee Data Processing: Managing the recruitment process, onboarding procedures, employment contracts, payroll, benefits administration, and conducting performance reviews.
- Operational Management: Streamlining internal processes, conducting audits, and verifying compliance with company policies and regulations.
5.3 Marketing and Event Coordination
- Event Management: Planning, organizing, and managing participation in seminars, webinars, networking events, and similar activities. This includes processing registration data and communicating event details.
- Feedback Collection: Gathering feedback from participants and clients to analyze and enhance our services.
- Marketing Communications: Sending newsletters, service updates, and promotional materials. Clients and contacts can opt out of marketing communications at any time.
5.4 Compliance and Legal Obligations
- Regulatory Compliance: Ensuring adherence to applicable laws, regulatory requirements, and responding to legitimate requests or orders from government bodies and authorities.
- Audit and Record-Keeping: Conducting internal and external audits, preparing legal compliance reports, and maintaining records as required by law.
5.5 Legitimate Business Interests
- Service Optimization: Performing internal analysis, strategic planning, and service development to improve client experiences and business efficiency.
- Security Measures: Protecting physical premises, IT systems, and data through security protocols, including the use of surveillance systems (e.g., CCTV) for safety and data protection.
- Fraud and Risk Management: Detecting, preventing, and responding to potential security risks, fraud, and unlawful activities to safeguard our operations and clients.
5.6 Handling Sensitive Data
- Sensitive Data Processing: Collecting and processing sensitive personal data (e.g., health information, biometric data) only when essential and with explicit consent, or where legally permitted.
- Data Minimization: Ensuring that sensitive data collected is strictly relevant to the purpose and that non-essential details are redacted in compliance with the PDPA.
6. Disclosure of Personal Data
We may disclose personal data to the following entities for purposes aligned with this Privacy Policy and as permitted or required by law:
- Affiliates and Partners: We may share data with affiliated firms to coordinate and provide comprehensive legal and business services.
- Professional Advisors and Subcontractors: Trusted law firms, legal consultants, and other professional service providers engaged to perform specific tasks on our behalf, including legal services, consulting, and specialized advisory functions.
- Service Providers: Third-party service providers who assist us in delivering our services, including IT support, cloud storage, marketing, event management, and data analytics. These providers are contractually obligated to protect the confidentiality and security of the personal data they process.
- Regulatory and Governmental Authorities: Law enforcement agencies, regulatory bodies, and other governmental entities as required by applicable laws, regulations, or legal proceedings. This may include compliance with court orders, subpoenas, or other mandatory disclosures.
- Business Partners: Selected partners involved in joint projects or collaborative initiatives, where data sharing is necessary for the execution and success of the partnership.
- Consent-Based and Legally Permitted Disclosures: We may share personal data with third parties when you have provided your explicit consent or where such disclosure is legally permissible for protecting our legitimate interests or those of other parties.
We ensure that any data shared is done so securely and only when necessary to fulfill the purposes outlined in this policy or to meet legal obligations.
7. Cross-Border Data Transfers
We may transfer personal data outside Thailand only where allowed by law. Appropriate measures such as data transfer agreements ensure data protection standards are upheld.
8. Data Retention
We retain personal data only as long as necessary for processing purposes, generally up to 10 years, or as required by law. After this period, we securely delete or anonymize the data.
9. Data Security
We implement robust measures to safeguard personal data against unauthorized access, disclosure, and destruction. These include both technical (e.g., firewalls) and organizational controls.
10. Your Rights
Under the PDPA, you have the right to:
- Access: Request access to your personal data.
- Rectification: Request corrections of inaccuracies.
- Erasure: Request deletion under certain conditions.
- Restriction: Request the limitation of processing.
- Data Portability: Request transfer to another data controller.
- Objection: Object to data processing.
For exercising these rights, please contact us at the provided details.
11. Cookies and Similar Technologies
Our website uses cookies and similar tools for user experience enhancement and analytics. These include:
- Essential Cookies: For basic website functionality.
- Performance Cookies: To analyze user interactions.
- Functionality Cookies: To remember user preferences.
- Advertising Cookies: To tailor content and ads.
We may use Google Analytics to collect insights on website use. Users can control cookie settings through their browser options. By continuing to use our site, you consent to these practices.
12. Changes to This Privacy Policy
We may revise this policy periodically. Updates will be posted on our website, and significant changes will be communicated through other means as appropriate.
13. Contact Information
For questions or requests regarding this policy, please contact:
AIM Bangkok Business & Legal Solutions (Thailand) Co., Ltd.
P23 Tower, 11th Floor, 11/2 Soi Sukhumvit 23, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand
Phone: +66 80 621 1665
Email: [email protected]