We, United Overseas Bank (Thai) PCL. (the “Bank”) and its financial group of companies, whose names appear in the Appendix attached to this Privacy Notice (“Privacy Notice”) (hereinafter collectively referred to from time to time as “we”, “us”, “our”, or “UOB Group”), value your privacy and strive to protect your personal data in compliance with the laws and regulations governing personal data protection, including those that are enforceable in Thailand, which impose legal obligations upon us.

This Privacy Notice explains:

• what kind of personal data we collect and why we collect it; this includes what you tell us about yourself and what we learn by having a legal relationship with you, and the choices you give us about what marketing materials you want us to send you;
• how we use your personal data;
• who we disclose your personal data to;
• how long we keep your personal data; and
• what your privacy rights as a data subject are and how the law protects you.

1. Collection of Personal Data

We use many different kinds of personal data. The type of data that we collect depends on the circumstances of the collection, the nature of requested service(s), and the transaction(s) performed.

We collect personal data about you from various sources as follows:

Information that you provide to us, namely:

• Personal details: these include any information concerning your identity, such as your given name(s), preferred name(s), gender, date of birth, marital status, personal identification card number or information, passport number(s) and other government issued number(s), tax identification number(s), nationality, images of passports, driving licenses, signatures, authentication data (e.g. passwords, your maiden name, PINs, e-signatures, facial and voice recognition data, and fingerprints data), photographs and visual images, details of your education and employment, names and contact details of your family members and dependents, or other identification information;
• Personal contact information: this includes any information you provide to us that would allow us to contact you, such as postal address, email address, social network details, or landline and mobile numbers;
• Financial information: any of your financial information and information about your relationship with us, such as your shareholding or ownership information;
• Details of others provided by you: these include any information that you have provided us about other persons with whom we may or may not have direct legal relationship, such as their personal details or personal contact information; such details of others could include your guarantors, trustees, the beneficiaries of your insurance policy, joint account holders, people appointed to act on your behalf, your business partners, officers or agents, and individuals whom you have referred to us, etc.;  
• Information from digital device: any information about the computer system or other technological device that you use to access any of our or third parties’ channels, applications, websites/sites or social media, as the case may be (collectively the “Sites”), in order to contact, communicate, visit or interact with us, such as IP addresses, operating system, network information, web browser type and version, cookies, activity logs, online identifiers, unique device identifiers, geo-location data, photographs, videos, voice recordings, type and features of device, apps loaded on the device, etc.;
• Website/communication usage information: as you use or navigate through and interact with our Sites, we use automatic data collection technologies (i.e. cookies, web beacon, or third party tracking for analytics and advertising purposes) to collect certain information about you and your activities, such as the links you click on, the pages or content you view, the content response times, the download errors and the length of visits. (Please refer to our Cookies Policy published on each of our websites for more information);
• Account login information: any information that is required to give you access to your specific account profile, for examples, your network type and Wi-Fi information, login ID/email address, subscription data, screen name, password in unrecoverable form, security question and answer, login credentials for phone and/or online banking and mobile banking applications;
• Demographic information & interests: any information that describes your demographics or behavioral characteristics; for examples, your date of birth, age or age range, gender, geographic location, favorite products, hobbies and interests, household or lifestyle information, the way you use products and/or services, including information about payments you make or receive such as the dates, amount, currency, and the details of your counterparties for the transactions, or your personal preferences relating to such transactions;
• Market research & feedback: any information that you voluntarily share with us about your experience of using the products and/or services offered by us, such as your needs and interests, information and opinions expressed when participating in a market research and/or survey, or contact information that you provide to us in order to receive news and updates from us;
• Data subject-generated content: any content that you create and then share with us on third party social networks or by uploading it to one of our Sites, such as photographs, videos, personal stories, or other similar media or content;
• Our customer support services: any communications with our officers, such as record of contact, complaints and/or disputes, emails or letters you send to us, record of your feedback, and record of advice that we may have given you; and
• Special categories of personal data (sensitive personal data): any sensitive data which is necessary for us to consider entering into an agreement with you, granting you products and/or services and to perform customer due diligence as required by law, e.g. information about criminal convictions and offences and biometric data.

Information we collect or generate about you, namely:

• Financial information: any of your financial information and information about your relationship with us, including any of our products and/or services or those offered by us (e.g. insurance products, mutual fund products, or other investment products), that you apply for or hold or have had in the past, the channels you use and your ways of interacting with us, your ability to get and manage your credit, credit and borrowing history, your payment history, instruction records, transactions records, market trades, payments into your account, including salary details and information, billing address, bank account numbers, credit or debit card numbers, cardholder or accountholder name and details, credit information, risk rating information, counterparty details, client relationship information, payment and trade transactions information, personal wealth, assets, and liabilities, proof of income and expenditures, and other financial information;
• Marketing and sales information: such as details of the products and/or services that you receive and your preferences;
• Investigations records: such as due diligence checks, sanctions and anti-money laundering checks, external intelligence reports, content and metadata relating to relevant exchanges of information between and among individuals, organizations, including emails, voicemail and live chat;
• Records of correspondence and other communications: such as email, live chat, instant messages and social media communications;
• Regulatory obligations: any information that we need to support our regulatory obligations, such as information about transaction details, shareholding information, detection of any suspicious and unusual activity and information about parties connected to you or these activities; and
• Audio-visual information and images: such as image and/or VDO recordings from surveillance videos on our premises and/or branches, or image and/or VDO recordings taken by us in other events.

Information we collect from other sources, namely:

• Specific information: any information you have asked us to collect for you, such as information about your accounts or holdings with other companies including transaction information and information on your preferences from other organizations where they have rights to share this information;
• Third party social network information: any information that you share publicly on a third party social network or information that is part of your profile on a third party social network and that you allow the third party social network to share with us, such as your basic account information (e.g. name, email address, gender, birthday, current city, profile picture, user ID, list of friends, etc.) and any other additional information or activities that you permit such third party social network to share;
• Third party providers: any information from third party providers, such as information that helps us to combat fraud or that relates to your social interactions (including your communications via social media between individuals, organizations, prospects and other stakeholders acquired from companies that collect combined information);
• Credit reference agencies: such as information received from the credit reference agencies and from other reference databases;
• Public sources: any information from other publicly available sources; and
• Customer Profile and Transaction Data: such as any information we received from third parties in relation to the sale or acquisition of assets, business, or portfolios, including your profile and transaction data, regardless of whether your account is active or closed, as well as voice recordings.

If you do not provide the necessary data or consent to the processing of data, which we indicate to you is mandatory, we may not be able to provide you with the products and/or services you require, or meet all our obligations we have with you, enter into a contract with you, or fulfil legal duties imposed on us by law. In such cases, our service to you may be limited, restricted, suspended, cancelled, prevented or prohibited, as the case may be.

If you give us personal data of other persons, or you request us to share their personal data with third parties, you confirm that such persons understand the information in this Privacy Notice about how we will use their personal data and that you have the rights to share their personal data to us.

We collect your personal data for the purposes that are within the scope of one or more lawful grounds described in Section 2, below.

2. Use of Your Personal Data

We may only collect, use and share (collectively “process”) personal data fairly and lawfully and for specified purposes (“lawful grounds”). The applicable data protection law restricts our actions regarding personal data to specified lawful purposes. These restrictions are not intended to prevent the processing of personal data, but to ensure that we process personal data fairly and without damaging your interests.

The lawful grounds for processing available under the applicable data protection law vary depending on the nature and purpose of the processing activities and the types of data being processed.

We will rely on one or more of the following lawful grounds when processing your personal data:

• when it is necessary to fulfil a contract or perform obligations we have with you or to act upon your request before entering into any contractual relationship with you;
• when it is our legal duty;
• when it is in our legitimate interest;
• when you consent to the processing of your personal data; and
• when it is necessary to prevent harms to your life, body, or health.

In the case of sensitive personal data or special categories of personal data under the applicable data protection laws, in addition to the lawful grounds above, we will process such data in accordance with any other additional requirements as prescribed by such data protection laws.

Some processing activities may fall under more than one lawful ground. In such case, we may rely on any of the applicable lawful grounds for our processing activities.

The purposes for which we may process personal data, subject to the applicable law, and the legal bases on which we may perform such processing includes:

3. Disclosure of Personal Data

We may share your personal data or personal data relating to the individuals connected to your business with third parties where it is lawful to do so, including where we or they:

• need to have access to your personal data in order to provide you with the products and/or services you have requested (e.g. fulfilling a payment request);
• have a public or legal duty to do so (e.g. to assist with detecting and preventing frauds, tax evasion and financial crime);
• need to have access to your personal data for the purpose of regulatory reporting, litigation or to assert or defend our or their legal rights and interests;
• have a legitimate business reason for doing so (e.g. to manage risk, verify identity, enable another company to provide you with services you have requested, or assess your suitability for products and/or services);
• need to prevent harms to your life, body, or health; and/or
• have asked you or the individuals connected to your business for the permission to share the personal data, and you (or they) have agreed.

In case of sensitive personal data or special categories of personal data under the applicable data protection laws, in addition to the lawful grounds above, we will share such data in accordance with additional requirements as prescribed by such data protection laws.

Some disclosure activities may fall under more than one lawful ground. In such case, we may rely on any of the listed grounds for our disclosure activities.

We may share your personal data or personal data relating to the individuals connected to your business for these purposes with others, including:

• other companies in UOB Group and any sub-contractors, agents or service providers who work for us or provide services to us or other companies in UOB Group (including their employees, sub-contractors, service providers, directors and officers);
• cloud service providers;
• any trustees, beneficiaries, administrators or executors;
• people who give or will potentially give guarantees or other security for any amounts you owe us;
• people you make payments to and receive payments from;
• your beneficiaries, intermediaries, correspondent and agent banks, clearing houses, clearing or settlement systems, market counterparties, and any companies the investment services of which you receive through us;
• our business partners with whom we provide services (e.g. airline or hotel partners, co-branding partners, card scheme partners or loyalty program partners), including their agents and service providers;
• our trusted partners (e.g. social media companies or advertisement agencies) for the purpose of conducting direct marketing activities on our behalf or other third parties;
• other financial institutions, lenders and holders of security over any property or assets you provide to us, tax authorities, trade associations, credit reference agencies, payment service providers and debt recovery agents;
• any fund managers, custodians, and trust administrators, who provide asset management services to you and any brokers who introduce you to us or deal with us on your behalf;
• insurance providers, including underwriters, brokers, agents, re-insurers, actuarials, claims handlers, hospitals, rescue centers, medical councils, CCTV management centers, third party administration (TPA), insured, insurance policyholders, insurance premium payers, witnesses, beneficiaries, heirs, related parties, parties in dispute, counterparties, injured, attorney-in-fact, creditors or debtors of UOB Group and other relevant third parties;
• any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition, takeover, assignment, transfer, participation or sub-participation, including any transfer or potential transfer of any of our rights or duties under our agreement with you;
• law enforcement, government, courts, dispute resolution bodies, our regulators, fraud prevention agencies, credit reference agencies, tax agencies, auditors and any party appointed or requested by our regulators to carry out investigations or audits of our activities, either having jurisdiction in Thailand or elsewhere;
• other parties involved in any disputes, including disputed transactions;
• fraud prevention agencies who will also use your personal data or personal data relating to the individuals connected to your business to detect and prevent fraud and other financial crime and to verify your identity;
• any person who provides instructions or operates any of your accounts, products and/or services on your behalf (e.g. Power of Attorney, lawyers, intermediaries, etc.);
• your advisors (e.g. accountants, auditors, legal advisors, professional, financial or tax advisors) who you have authorized to represent you, or any other person of whom you have informed us is authorized to give instructions on your behalf; and/or
• any other person with whom we have been instructed by you to share your personal data, or any other person who provides instructions or operates any of your accounts on your behalf.

Under some circumstances, the recipients of your personal data listed above may be located outside of Thailand. We will ensure that the cross-border transfers of your personal data comply with Section 4, below.

The purposes for which we may share personal data, subject to the applicable law, and the legal bases on which we may share personal data are set out in Section 2, above.

There may be instances which we may share your personal or non-personal data to third parties, such as advertising identifiers or one-way coding (cryptographic hash) of a common account identifier (such as a contact number or email address) to enable the conduct of targeted advertising.

We will not use personal data for any other purpose other than for the purposes as described to you. Should we intend to collect or use additional data, which is not described in this Privacy Notice, we will notify you and/or obtain your consent prior to the collection, use or disclosure in order to comply with relevant data protection laws.

4. Transfers of Personal Data Outside of Thailand

Your personal data may be transferred to and processed in all countries where group companies of UOB Group or their service providers have established a business presence or have to meet compliance obligations. We will take all steps that are reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice as well as with the applicable data protection laws, including, where relevant, by entering into applicable standard contractual clauses (or equivalent measures) with the parties outside of Thailand.

5. Opting Out of Direct Marketing

You have the right to object to direct marketing activities.

If you do not wish to receive marketing information from us, you may click on the ‘unsubscribe’ link, which can be found in our marketing emails and/or newsletters which are sent to you, fill up the “Opt-out” form provided at the Bank’s branches, or speak to any Customer Service Officer at 0-2285-1555.

If your account was transferred from Citibank N.A., Bangkok Branch or if you are a customer of UOB Capital Services Company Limited (formerly, Citicorp Leasing (Thailand) Company Limited), you may request to object to direct marketing activities via CitiPhone Banking at 1588 or email to citibankthailand@citi.com.

6. Retention of Personal Data

We collect your data for as long as it is necessary to carry out the purposes for which it was collected, for business, legal and legitimate interest purposes or compliance with applicable laws.

We may keep your personal data for up to 10 years after you stop being our customer or counterparty (that is, after our relationship with you has ended) to ensure that contractual disputes can be processed within that time. However, for legal, regulatory or technical reasons, we may keep your data for longer than 10 years. This includes circumstances where we keep records of any person exercising the rights under the applicable data protection laws; for example, where a person has opted out from our direct marketing or has requested us to erase personal data. If we do not need to retain personal data for longer than the period that is legally necessary, we will destroy, delete or anonymize your personal data according to our deletion cycles. 

Where you receive products and/or services from third parties (e.g. insurance companies) who we have introduced you to, those third parties may keep your personal data, or personal data relating to the individuals connected to your business, in line with additional terms and conditions that apply to their product and/or services.

7. Accuracy of Your Personal Data

We need your co-operation to ensure that your personal data is current, complete, and accurate. Please inform us of any changes to your personal data by contacting us at 0-2285-1555 or by updating your information at our places of business and/or branches.

We will occasionally request updates from you and we may, in certain circumstances, proceed with such updates without your request to ensure the personal data we use to fulfil the purposes of the collection, use and disclosure is updated, complete and accurate.

8. Your Data Subject Rights

Subject to the conditions and exceptions set out in the applicable data protection laws, you enjoy the following rights:

• Right to Withdraw Consent: This enables you to withdraw consent that you have already given to us. The withdrawal of your consent will not affect any processing of your personal data carried out prior to your withdrawal being effective.
  
  Where your consent is not mandatory, the withdrawal thereof may partially or completely impede our ability to provide you with full benefits or experience relating to the products and/or services you receive.
  
  Where your consent is mandatory, the withdrawal thereof may render our service limited, restricted, suspended, cancelled, prevented or prohibited or render us unable to perform our contractual obligations with you or take steps at your request prior to entering into an agreement with you, as the case may be.
  
  For either case, we will not be liable to you for any losses incurred, and our legal rights are expressly reserved in respect of such limitation, restriction, suspension, cancellation, prevention or prohibition.
  
  Consequences of withdrawal or absence of consents of each type
  
  
  • If you withdraw or do not give your consent for us to offer financial products/services that are personalized to suit your needs (Personalized Offers), you will still receive marketing offers but they will not be personalized to suit your needs and interests unless you have already opted out of direct marketing through various channels.
  • If you withdraw or do not give your consent for us to disclose your personal data to social media service providers for offering financial products/services via online communication channels, we will not share your personal data to any social media service provider to conduct online advertising targeting you.
  • If you withdraw or do not give your consent for us to use your biometric data (Biometric Data Consent), we will not use your biometric data in any transaction.
  • If you withdraw or do not give your consent for us to disclose your personal data to third parties for their marketing purposes (Third Party Disclosure Consent), we will not share your personal data with such third parties for their marketing purposes.
    
    
• Right to Access: This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Right to Correct: This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Right to Deletion: This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to the processing of your personal data (see below).
• Right to Object: This enables you to object to the processing of your personal data where we are relying on a legitimate interest (or that of a third party) and your particular circumstances justify your objection to the processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Right to Restrict Processing: This enables you to ask us to suspend the processing of personal data about you; for example, you may want us to restrict the use of your personal data which is under our correction process.
• Right to Portability: Request the transfer of your personal data to another party.
• Right to Complain: You may lodge a complaint with the local data protection authority if you believe that we have not complied with the applicable data protection laws. 

Please complete the “Consent Withdrawal” form or “Data Subject Rights” form provided at the Bank’s branches and submit it to any Customer Service Officer at any of the branches. Please also note that we will ask you to provide a proof of identity to us before responding to any requests to exercise your rights. We will respond to your request to exercise such rights without delay and we will notify you in advance if we require more time to process your request.

If you become or have become the Bank’s customer or counterparty before 1 June 2021, the Bank will maintain and continue using your personal data based on the consent you previously given to the Bank. Your right to withdrawal of consent also applies to consents that were given to the Bank before 1 June 2021. If you wish to withdraw such consent, you may do so by completing the “Consent Withdrawal” form provided at the Bank’s branches and submit it to any Customer Service Officer at any of the branches. The Bank will process your request accordingly.

Please note that the abovementioned rights are not absolute, as they should be balanced against legal requirements and our legitimate interest. We reserve our right to charge fees for processing your request as announced by UOB Group from time to time.

If your account was transferred from Citibank N.A., Bangkok Branch or if you are a customer of UOB Capital Services Company Limited (formerly, Citicorp Leasing (Thailand) Company Limited), you may exercise your rights as a data subject as mentioned above via CitiPhone Banking at 1588 or email to citibankthailand@citi.com.

Handling of Complaints

In the event that you wish to make a complaint about how we process your personal data, please contact us and we will try to consider your request as soon as possible. Your complaint filing that is made with us does not prejudice your right to file a complaint with a government authority with the mandate to enforce data protection law.

9. Security of Your Personal Data

We value your privacy, therefore, we place great emphasis on ensuring the security of your personal data. We regularly review and implement reasonable and appropriate physical, technical and organizational security measures when processing your personal data.

Our employees are trained to handle the personal data securely and with respect, failing which they may be subject to disciplinary actions.

10. Cookies

We use cookies in some of our webpages and applications to collect information about users of each of our websites (for example, store users’ preferences and record session information). A cookie is a small text file that a website or application can send to your browser, which stores certain information on your system. We use different types of cookies for different purposes. This includes the purposes of improving your online experience and customizing the ads you see online. You can adjust the settings on your browser or within your mobile device so that you will be notified when you receive a cookie. You may, at any time, disable the cookies by changing the settings on your browser or via your mobile device. However, by doing so, you may not be able to use certain functions or enter certain part(s) of the websites.

For more information on how we use cookies, please refer to our Cookies Policy published on each of our websites for more information.

11. Provisions for Data Subjects Residing in the European Economic Area (EEA)

A. Automated Processing
In order to provide our products and/or services, the processing of your personal data may include profiling by using software that can analyze your behaviors to predict possible outcomes and risks. We may rely on such profiling and/or other automated methods to make decisions about you in relation to our activities stated in this Privacy Notice.

B. Transfers of Personal Data Outside of the EEA
Your personal data may be transferred to and processed in all countries where group companies of UOB Group or their service providers have established a business presence or have to meet compliance obligations. We will take all steps that are reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice as well as the applicable data protection laws, including, where relevant, by entering into EU standard contractual clauses (or equivalent measures) with the parties outside of the EEA (available here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en).

For the avoidance of doubt, this Section 11 does not apply to data subjects who are non-EEA residents.

12. Contact Us

Please contact us at 0-2285-1555, email us at UOBCallCentre@uob.co.th, if you have any questions regarding the protection of your personal data, or speak to any Customer Service Officer at any of the Bank’s branches.

You can also contact our Data Protection Officer, who is responsible for overseeing the protection of your personal data, by writing to:

The Data Protection Officer
United Overseas Bank (Thai) PCL. Head Office
690, Sukhumvit Road, Khlong Tan,
Khlong Toei, Bangkok 10110

Or you can send an email to TH-DPO@uob.co.th

13. Revision of our Privacy Notice

You can request for a copy of this Privacy Notice using the contact details in Section 12, above.  However, we keep this Privacy Notice under regular review; thus, this Privacy Notice may be subject to any changes. The date of the latest revision of this Privacy Notice can be found at the top of the page.