Privacy Policy
Privacy Notice for Customers
Last updated: March 2026
Cibes Lift (Thailand) Company Limited (hereinafter referred to as the “Company”) recognizes the importance and duties under the Personal Data Protection Act B.E. 2562, with the emphasis on respecting the privacy rights of customers. This includes natural persons acting on behalf of the entity whose personal data is the subject (hereinafter referred to as “Customer”), and is committed to protecting your personal information securely and ensuring that the customer’s personal information will be protected in accordance with the Personal Data Protection Law and other relevant laws. The Company has therefore prepared this privacy notice to notify you of the details related to the collection, use, and disclosure (collectively, “Processing”), including your legal rights as a data subject. The details are as follows.
Contents
- Article 1. Who does this Privacy Notice apply to?
- Article 2. Personal data
- Article 3. Personal data collected by the Company
- Article 4. Source of personal data
- Article 5. Purpose of collection, use and disclosure of personal data
- Article 6. Disclosure of your personal data
- Article 7. Obtaining Consent and Possible Consequences of Withdrawing Consent
- Article 8. Sending or Transferring Personal Data Overseas
- Article 9. Retention and period of retention of your personal data
- Article 10. How does the Company protect your personal data?
- Article 11. Rights of data subjects
- Article 12. Links to Third Party Websites
- Article 13. Changes to the Privacy Notice for Customers
- Article 14. Contact channels
- Article 15. Governing Law
Article 1. Who does this Privacy Notice apply to?
This privacy notice covers customer personal information. This includes natural persons acting on behalf of juristic persons who own personal data, such as directors, consultants, executives, employees, agents, and any person related to the Company’s personnel or services. It also includes participants in campaigns or marketing activities of the Company, people who are interested in the products or services of the Company through various channels, and/or users of various services of the Company through online and electronic media, as the case may be. This includes those authorised to act on behalf of customers according to the law, as the case may be, such as those using parental authority of minors, caregivers of the incompetent, guardians of the quasi-incompetent, etc.
Article 2. Personal data
“Personal data” means information about a person that can identify that person either directly or indirectly, but does not include information about the deceased — such as name, surname, address, telephone number, ID number, social security card number, taxpayer identification number, e-mail address, IP address, Cookie ID, Log File, etc. However, the following information is not personal information: information for business dealings that does not identify an individual, such as company name, address of the company, company registration number, work phone number, work email address, company group email (e.g. [email protected]); Anonymous Data that has been de-identified; Pseudonymous Data where individuals can be re-identified by technical means; deceased person information; etc.
However, later in this privacy notice, if not specifically mentioned, “Personal Data” and “Sensitive Personal Data” relating to users of the foregoing services are collectively referred to as “Personal Information”.
In case the Company receives a copy of your ID card, or the Company takes your information out of the ID card by electronic means for the purpose of identity verification in establishing a legal relationship and/or any transaction with the Company, the information received will also contain religious information. This is considered sensitive data (Sensitive Data). The Company does not have a policy to collect sensitive personal data from you, except in the event that the Company has obtained your consent. The Company will determine the management method according to the guidelines and as permitted by law.
Article 3. Personal data collected by the Company
The Company collects your personal information as necessary, according to the purpose of using the information that the Company will inform you of in the next sections. The types of personal data that the Company stores are classified as follows:
| Types of personal information | Details |
|---|---|
| Basic personal information | Such as title, name, surname, gender, date of birth, age, identification number, current address, residential address, e-mail address, telephone number. |
| Other information | (a) Contact Data, such as address, telephone number, e-mail address, LINE account name (LINE ID), Facebook account name (Facebook ID) and accounts on other social media sites, and contact in case of emergency. (b) Financial data, such as bank account numbers. (c) Company contact information (Communication Data), such as video or audio recording data when contacting the Company. (d) Event participation information, such as still images or video recordings. |
Article 4. Source of personal data
The Company collects your personal information and sensitive information through the following processes:
- 4.1 Information that you provide directly to the Company, such as information appearing in an application for service, including supporting documents; requests to change personal information or other information; service requests or other information requests about the products or services of the Company; product and/or service complaint information; information used to register and create an account (Account) or Profile with the Company to use the Company’s services through both offline and online channels; your contact information with us, whether written or electronic; as well as information you provide through surveys, suggestions or comments through various channels, including information you use at the head office or branch office, customer service centers or booths that showcase products or services, etc.
- 4.2 Information automatically collected by the Company when you access the service through the Company’s system or visit the Company’s website via electronic devices such as mobile phones, computers, laptops, etc.
- 4.3 Information from external sources or reliable public information, such as the Department of Provincial Administration, the Department of Business Development, commercial resources, websites, applications, social media resources, Data Providers, and entities or companies or associations or confederations associated with your products or services, etc.
- 4.4 Information that you contact the Company, employees, agents, business partners or partners of the Company, authorized persons or persons acting on their behalf, or other persons or agencies involved or assigned by the Company through the website, applications, social media, telephone, email, meetings, interviews, short messages (SMS), fax, postal mail, video, call service or any other means. The Company may collect information in the form of text messages, as well as pictures and sound.
- 4.5 Information that you provide when you participate in activities with the Company — marketing activities, contests, sweepstakes, events or competitions organized by or on behalf of the Company and/or business partners or alliances. When you provide any personal information related to third parties to the Company (including but not limited to family members and others related to customers who use the service), you represent and warrant the accuracy of such personal information, and that you have fully informed them about this Privacy Notice.
Article 5. Purpose of collection, use and disclosure of personal data
The Company collects, uses or discloses your personal data under the following data processing bases:
- 5.1 Contractual Basis — for the performance of contracts that you are a party to, such as employment contracts, sales contracts, service contracts, or any other contract; or to process your request/application prior to entering into a contract, as the case may be.
- 5.2 Compliance with the law (Legal Obligation) — to perform duties as required by law, such as labor protection laws, social security law, tax law, electronic transactions law, civil and commercial law, etc.
- 5.3 Legitimate Interest — for the legitimate interests of the Company, not exceeding the extent that you can reasonably expect, which will not infringe on your fundamental rights or freedoms.
- 5.4 Consent — the Company will ask for your consent where the law requires consent, or where the Company has no reason to use the above processing bases to process personal data collected from you.
The Company collects, uses or discloses your personal information with the following objectives:
| Objective of operations | Details | Data processing bases |
|---|---|---|
| Pre-contract processing & performance of contract | To sell products and/or services to you or comply with any contract to which you are a party — subscription information, delivery, accounting and financial operations, after-sales service and returns, and any action for you to receive goods and/or services as requested. | Performance of contract |
| Advertising and public relations | Advertising, marketing campaigns, analysis, product development, contacting customers to give advice or present products, including management of advertising/PR media in which you are the presenter or appear as part of the Company’s media. | Consent; Legitimate interests |
| Operational management & after-sales care | Review and analyze personal data; develop the Company’s online service channels; allow you to access or transfer account information, member numbers or personal codes across devices; monitor account access to prevent unauthorized or fraudulent use; and improve the Company’s service. | Contract; Legitimate interests; Consent |
| Information technology management | Set up information systems to collect and process data; connect information with customers and representatives; and provide IT services to process customer information from the use of the Company’s websites, applications and social media (e.g. Facebook, Line). | Compliance with the law; Legitimate interests; Consent; Contract |
| Business management & effectiveness | Manage, develop and implement the business more efficiently — management of goods and/or services (including websites and applications); detecting and preventing fraud or other crimes; customer and potential-relationship management; maintenance and use of IT systems; and measuring the effectiveness of the Company’s marketing and advertising. | Compliance with the law; Legitimate interests |
Article 6. Disclosure of your personal data
To carry out the purposes stated in this Privacy Notice, your personal information may be disclosed or delivered to various agencies within the Company and to individuals or entities outside the Company, as follows:
- 6.1 Within the Company — your personal data may only be disclosed or delivered to the relevant departments within the Company that have a role, to the extent necessary for the purpose. These individuals or teams will be allowed to access your personal data only as necessary and appropriate.
- 6.2 Outside the Company — your personal data may be disclosed or delivered to external organizations as follows:
- 6.2.1 Government agencies, regulators or other agencies as required by law, such as the Revenue Department, the Department of Business Development, the Ministry of Commerce, auditors, governments, courts, legal execution departments, or any other agencies that hold legal authority.
- 6.2.2 Organizations or third parties that have contacted the Company for the purpose of verifying your transactions and in order to provide you with services or products to meet your needs.
Article 7. Obtaining Consent and Possible Consequences of Withdrawing Consent
7.1 In the event that the Company collects, uses or discloses personal data based on your consent, you have the right to withdraw your consent given to the Company at any time. The withdrawal of this consent will not affect the collection, use or disclosure of personal data for which you have already given consent.
7.2 If you are a minor under the Civil and Commercial Code, before giving consent please inform the Company of the details of the person using parental authority, so that the Company can proceed to obtain consent from that person as well.
You may withdraw your consent to the collection, use or disclosure of all or part of your personal data, as stated in this Privacy Notice, by informing the Company. If you withdraw your consent for the Company to collect, use or disclose your personal data for reasons or purposes other than marketing operations, the Company may not be able to perform procedures or services and/or manage the products or your relationship and/or account with the Company. This may cause you to lose benefits in using the Company’s services.
Article 8. Sending or Transferring Personal Data Overseas
8.1 The Company may send or transfer your personal data to other persons both domestically and internationally, where necessary to perform a contract to which you are a party, or under a contract between the Company and another person or juristic person for your benefit; or to process your request before entering into a contract; or to prevent or suppress a danger to the life, body or health of you or another person; to comply with the law; or where it is necessary to carry out a mission in the interests of the public.
8.2 The Company may store your information on a computer, server or cloud provided by other parties, and may use third-party programs or applications in the form of ready-made software and platform services to process your personal data. The Company will require those other persons to have appropriate personal data security protection measures.
8.3 In the event that it is necessary to send or transfer your personal data to foreign countries, the Company will comply with personal data protection laws and take appropriate measures to ensure that your personal data is protected and that you can exercise your rights. The Company will require the recipient of your personal data to have appropriate protection measures, to process such personal data only as necessary, and to take steps to prevent unauthorized use or disclosure.
Article 9. Retention and period of retention of your personal data
9.1 The Company will keep your personal data for as long as necessary, taking into account the necessity and purpose for which the Company must collect, use and process it, including complying with applicable legal requirements.
9.2 The Company will continue to collect, use and disclose your personal data even if you terminate your relationship with the Company, as required by law, for legitimate interests, or by collecting it in a form that makes it impossible to identify a person either directly or indirectly (Anonymous Data or Pseudonymous Data).
9.3 The Company may keep your personal data for as long as necessary to achieve the purpose of data processing described in this Privacy Notice. The Company will keep your personal information for no more than 10 years from the date you terminated the relationship or last contacted the Company. The Company may retain your personal information for longer than required if permitted by law.
9.4 The Company will conduct an investigation to remove or destroy personal data, making it impossible to permanently identify the owner of the personal information, or otherwise to limit all personal data, after the expiration of the retention period.
Article 10. How does the Company protect your personal data?
The Company prioritizes the security of your personal information, using measures such as encryption and restriction of access to personal information, to ensure that our personnel and third parties acting on behalf of the Company adhere to appropriate standards of personal data protection. This includes the obligation to prevent the leakage of information and to take appropriate security measures in relation to the processing of information.
The Company keeps your personal data carefully in accordance with technical measures and organizational measures to secure the appropriate processing of personal data and to prevent personal data breaches. The Company has established policies, regulations and criteria for personal data protection, including measures to prevent recipients of information from using or disclosing information outside the objectives, without power, or wrongfully; and the Company updates these policies periodically as necessary and appropriate. Executives, employees, contractors, agents, consultants and recipients of information from the Company are obligated to maintain the confidentiality of personal information in accordance with the confidentiality measures set by the Company.
The Company regularly reviews and updates the procedures and security measures of the Company’s personal information to obtain a level of security suitable for the risk, and to ensure the confidentiality, completeness, availability and flexibility of processing personal data on an ongoing basis — including protection against loss and against unauthorized access, use, alteration or disclosure of personal data. The Company’s personal data security applies to all types of personal data processing, whether electronic or in document format.
Article 11. Rights of data subjects
You have the right to do the following:
- Right to withdraw consent — if you have given consent for the Company to collect, use and/or disclose your personal data (whether before or after the Personal Data Protection Law came into force), you have the right to withdraw your consent at any time while your personal data is with us, unless restricted by law or by a contract that benefits you. Withdrawing consent may affect your use of products and/or services.
- Right to access personal information — you have the right to access your personal data and request a copy, including requesting the Company to disclose how it acquired personal data not obtained with your consent, unless restricted by law or a court order.
- Right to data portability — you have the right to obtain personal data the Company holds in a format that can be read or used by automated tools, and to have it sent or transferred to another data controller by automated means where technically possible.
- Right to object to data processing — you have the right to object to the collection, use and/or disclosure of your personal data at any time where processing is based on legitimate interests or a public-interest task, and to object to processing for direct marketing or for scientific, historical or statistical research purposes.
- Right to request deletion of personal data — you have the right to have your personal data deleted, destroyed or anonymized where it was processed unlawfully, is no longer necessary, or where you have withdrawn consent or objected, unless the Company must retain it to comply with the law or assert legal rights.
- Right to request suspension of use of personal information — you have the right to temporarily suspend use of your personal data while the Company investigates a correction request or objection, or in other cases as permitted by law.
- Right to rectification of personal data — you have the right to request the Company to correct your personal data to be accurate, current, complete and not misleading.
- Right to complain — you have the right to lodge a complaint with the relevant legal authority if you believe the collection, use and/or disclosure of your personal data violates or does not comply with applicable laws.
If you have concerns or questions about the Company’s practices regarding your personal information, please contact the Company using the contact details in Article 14 of this Privacy Notice. You also have the right to submit a complaint to the expert committee appointed by the Personal Data Protection Committee, in accordance with the rules and procedures prescribed by the Personal Data Protection Law. When the Company receives a request to exercise rights, it will be processed within the period specified by law. The Company reserves the right to refuse or be unable to process such requests where permitted by law (for example, to comply with laws or court orders, for public interest, or where the exercise of rights would violate the rights or liberties of others), and will inform you of the reason for any refusal.
Article 12. Links to Third Party Websites
To use the service of the Company’s website, there may be links to other social networks, platforms and websites operated by third parties. The Company endeavors to only link to websites that meet privacy standards. However, the Company cannot be held responsible for the content or the privacy standards of such other websites unless otherwise specified. Any personal information you provide to third-party websites will be collected by those parties and subject to their privacy notice/policy (if any). The Company asks you to study and comply with the privacy notices/policies that appear on those websites, separately from the Company.
Article 13. Changes to the Privacy Notice for Customers
The Company will regularly review this privacy notice for customers to comply with relevant guidelines, laws and regulations. If there are changes, the Company will notify you of any significant changes together with an updated Privacy Notice through appropriate channels. The Company recommends that you review the changes to this privacy notice periodically.
Article 14. Contact channels
If you consider that the processing of your personal data is not in accordance with the Personal Data Protection Act B.E. 2562, you have the right to complain to the Personal Data Protection Officer.
Personal Data Protection Officer (Data Protection Officer)
Cibes Lift (Thailand) Co., Ltd. (Head Office)
Taxpayer Identification Number: 0105559027366
Tel. 02-114-6500
E-mail: [email protected]
891/49-52 Rama 3 Road, Bang Phongphang, Yannawa, Bangkok 10120
Article 15. Governing Law
You acknowledge and agree that this Privacy Notice is governed by and construed in accordance with the laws of Thailand, and that the courts of Thailand shall have jurisdiction over any disputes that may arise.
Announced on May 31, 2026.