We, Dusit Thani Properties REIT Company Limited (“Company”, “we”, “us”, “our”), as a controller of Personal Data, is bound by Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). We are committed to comply with PDPA to protect your persona data. This policy describes how we process or perform on your Personal Data such as collection, recording, organization, storage, alteration, use, disclosure, forward, and dissemination as follows:
Collection of Personal Data
We may collect Personal Data directly and indirectly from data subject, his representative or other related persons, through website, business partners, call center and online communication channels as well as other reliable sources such as association, governmental organization, governmental body, private organization, etc.
Types of Personal Data Collected
We may collect or obtain the following types of information which may include your Personal Data directly or indirectly from you or other sources. The specific type of Personal Data collected will depend on the context of your interactions with us.
- Your personal data as the registered unitholders, including full name, nationality, occupation, current address, number of units being held, e-mail, phone number and your bank account information
- Your personal data as the interested investors who contacts the Company via investor relations channels, e.g., full name, contact information, including place of work, work address and work title
- Your inquiries, correspondence, or email subscription status
- Details of anyone Authorized to act on your behalf if applicable
- Record, store and use of any images, video and audio data when you have investor/analyst meeting, site visit or open house with us including press conference
- Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website
We will retain your Personal Data as long as it is necessary for the purpose of data processing. After that, We will erase and destroy your Personal Data except as may be required, by applicable laws, or for protection of our interest. In general, your Personal Data will be kept for a maximum period of 10 years or otherwise longer if it is specifically provided by law.
Purposes of Use and Disclosure
We will use and disclose your Personal Data for the following purposes:
- Deliver meeting invitation and other notices to as the unit holders, debenture holders, investors, analysts as may be required under the relevant laws, for instance, the invitation to the general annual unitholders’ meeting, investor/analysts meeting or the submission of the annual business report/media releases, newsletters of the Company to you
- Verify your identity or the rights of your proxy who will be attending the shareholders’ meeting
- Verify your right to transfer your shares
- Allocate and pay distribution to you as the unitholder
- Perform accounting and bookkeeping as required under the applicable laws
- Manage and respond to your inquiries, feedback, complaints
- Prepare the annual report that the Company shall be obliged under the applicable laws to prepare that may include your personal data as the majority shareholders and to deliver those reports to the relevant government authorities or the public pursuant to the terms and conditions prescribed under the applicable laws
- Maintain network and data security
- Comply with applicable laws that require us to process certain Personal Information
In the case where the Company appoints third party service provider(s) to process your Personal Data, we will process your Personal Data for the purposes of performing Company’s contractual obligations, compliance with legal obligations, based on Company’s legitimate interests or based on your consent (if necessary). We will not disclose or permit the disclosure or make available your Personal Data other than in accordance with the relevant ground unless a prior consent of data subject has been given to the Company or PDPA allows us to do so without obtaining consent from data subject.
If any data subject could not share Personal Data necessary for the Company to process Personal Data based on the ground specified above, we will not be able to perform its contractual obligations with such subject matter nor able to comply with legal obligations. We will process Personal Data in strict compliance with applicable laws. In case where you have given a consent to any data processing activity, you may withdraw your consent at any time.
We will not disclose your Personal Data without any legal basis. Your data may be disclosed or transferred to governmental organizations, governmental bodies or third parties including:
- Service Providers/ Vendor: We may share your Personal Information to our third-party service providers, subcontractors and other associated organizations such as Thailand Securities Depository Company Limited as the Company’s registrar for the purposes of carrying out a task in accordance with any obligations that the Company may have with you. However, when we share your Personal Information with third parties, we disclose only the Personal Information that is necessary to deliver the service and we have a contract in place that requires them to keep your Personal Information secure and only for the duration it is required to carry out that specific task. In some cases, they will be acting as a data controller of your data and therefore we advise you to read their privacy notice. Such third-party companies may fall under the following categories: tax consultants, financial advisors, content protection, etc.
- Government Authorities: We may share Personal Information to relevant government authorities to fulfill any legal obligations and/or requirement we may have.
We will disclose your Personal Data to the recipient outside of Thailand only where it is necessary to perform any obligations that the Company may have with you and only when it is permitted by PDPA or other applicable laws.
In the event where the Company is required to disclose your Personal Data to a third party, we will follow appropriate procedures to ensure that the third party will properly handle your Personal Data in order to prevent data loss, unauthorized access, improper use, modification, disclosure or processing.
Data Security Measure
We adopt the high-standard security system in both technology and procedures to prevent any possible data theft. We implement various measures to protect its computer system (such as Network Firewall, Intrusion Detection, Threat Prevention, URL Filtering, Application Control, Email Security, Server and Endpoint Protection, Secure Socket Layer, Cookies), through substantial investments, effort and human resources as to ensure that we achieve high-standard measures, and your personal data remains safe.
Although we make its best efforts to protect personal data with our technical mechanism along with the management by our personnel to control access and keep personal data against unauthorized access, wet cannot always guarantee the security and confidentiality of personal data from every incident that may arise, such as virus threat and unauthorized access. A data subject should regularly keep up with technology news, install personal firewall software to prevent his computer from threat or data theft.
Right of Data Subject
In exercising any right under this Clause, data subject shall comply with criteria and procedures specified in this Clause of this document. However, the rights specified in this are subject to change as the relevant law may be amended from time to time by the government. We will inform you about the changes.
- Right to be notified: if we wish to collect, store, use or disclose your Personal Data in any manner beyond the intended purposes or your given consent, we will notify and/or seek your prior consent with respect to such additional scope.
- Right to Access to your Personal Data: You may request for a copy of your Personal Data and request to disclose about the source of your Personal Data.
- Rectification of the Personal Data: To ensure that your Personal Data is accurate, up to date, complete, and not misleading, you may file a request to rectify any of your Personal Data that has been changed.
- Right to data portability: In case where it is technically available, you may request to receive your Personal Data in a commonly used or readable by the automatic device or to automatically transfer.
- Right to erasure of your Personal Data: You may request to erase or make your Personal Data pseudonymized under any of the following circumstances: (a) your Personal Data is no longer needed to be collected, stored, used or disclosed for the intended purposes, (b) you withdraw your consent for your Personal Data to be collected, stored, used or disclosed and Dusit no longer has any legal right to process your Personal Data for the intended purposes, (c) you object to Company’s processing of your Personal Data, or (d) your Personal Data was processed in contravention of the PDPA.
- Request to suspend the use of your Personal Data: You may request the Company to suspend its use of your Personal Data in any of the following events:
- when the Company is in the process of verifying certain information for the purpose of rectifying, updating, completing or avoiding any misleading about your Personal Data upon your request;
- when your Personal Data is to be erased but you instead request to suspend its use;
- when it is no longer necessary to store your Personal Data, but you request the Company to continue the storage of your Personal Data for establishing legal claims, legal compliance, exercise of legal rights or defenses; or
- when the Company is in the process of verifying its legitimate rights in its data collection or processing for purposes specified by law.
- Right to object the processing of Personal Data: You may object to the collection, storage, use or disclosure of your Personal Data in any of the following events:
- In case where your Personal Data was collected by the Company for the purpose of (a) Company’s compliance with a governmental order or (b) any legitimate interest of Company or other legal entity;
- In case where the Company has processed your Personal Data for the purpose of direct marketing; and
- In case where the Company has processed your Personal Data for any research purposes as specified in relevant laws, including for statistical purpose.
- Right to withdraw consent: You may withdraw your consent at any time. Your withdrawal will not have any effect on Company’s previous data processing. If your withdrawal will affect any part of your Personal Data, we will notify you of such effect at the time you make such withdrawal.
However, we may deny your request to withdraw consent if the processing is for the purpose of, or for complying with, applicable law or court order, the withdrawal may adversely affect and harm the rights and freedom of the data subject himself or other people, the processing is for research purposes that has appropriate protection for Personal Data, or the processing is for establishing legal claims, legal compliance, exercise of legal rights or defenses.
Dusit Thani Properties REIT Company Limited
319 Chamchuri Square Building 29th Floor, Phayathai Road, Pathumwan, Bangkok 10330, Thailand
Tel: 02-200-9999 Ext 3680-3684