Privacy Policy Welpay
Thailand

The use of this information is for the following primary purposes:

1. Enter into relevant sale and purchase agreement;
2. Communication of services, sale and purchase transactions;
3. Payment transaction processing;
4. Settlement of fund, Refund or Cancellation, Dispute and/or Chargeback of the payment transaction;
5. Recurring payment service and/or tokenization;
6. General administration;
7. Manage and maintain your account(s) and facility(ies) with us;
8. Respond to your enquiries and complaints and to generally resolve disputes; i. Update, consolidate and improve the accuracy of our records;
9. Produce data, reports and statistics which have been aggregated in a manner that does not identify you as an individual;
10. Conduct research and survey, which solely for analytical purposes including but not limited to data mining and analysis of your transactions with us;
11. Meet the disclosure requirements of any law binding on us;
12. For audit, compliance and risk management purposes;
13. Any other purpose that we deem necessary and/or as required or permitted by any law, regulations, guidelines and/or relevant regulatory authorities.

For purposes of this Policy, 'User's Information' means information that identifies users, history of actions on communication services and other information created or accumulated in relation to user or users' devices, which shall be collected by the Company pursuant to this Policy. Depending on the method of collection, the User's Information that we may collect for a user to use the Services includes:

• (i) information provided by the user, including Personal data that we may collect:
  1. Name, Age, Race, Gender, Nationality, ID Number, Passport Number, Date of Birth;
  2. Contact Details such as House Number, Mobile Number; Email Address; Home Town Address; Correspondence Address; Delivery Address
  3. Credit card information;
  4. Bank Account number;
  5. photographs; and
  6. other information entered by the user into such form as specified by the Company;
• (ii) information provided from services outside the Services to the extent that the user permits for use with the Services;
  The Company may collect the following information from services outside the Services, including but not limited to social network services, to the extent the user permits for use with the Services at that time: ID used by the user for such outside service; and Authorized
• (iii) information collected by the Company for the use by the user of the Services

  The Company may collect information upon access to or use of the Services, including:

  1. terminal information
  2. log information
  3. cookies and anonymous ID; and
  4. location information.

The User's Information may be used not only for provision of the Services as provided in Section 3.2 but for other purposes as provided in Section 3.3

Specific purposes of the User's Information for the provision of the Services shall include the following:

1. Provision, maintenance, protection, and improvement of the Services, including but not limited to acceptance of registration for the Services, identification of individuals and computation of use fees;
2. Guidance or response to inquiries relating to the Services;
3. Addressing a violation of rules, regulations or policies relating to the Services (the 'Rules');
4. Notice of any modification to the Rules; and
5. Other purposes incidental to the foregoing.

Purposes other than those specified in Section 3.2 above shall be as indicated below:

1. Creating statistical data relating to the Services, in a form that cannot identify an individual;
   1. device information
   2. log information
   3. cookies and anonymous ID
   4. location information
2. Delivering or displaying advertisements of the Company or third parties; And
   1. device information
   2. log information
   3. cookies and anonymous ID
   4. location information
3. other marketing
   1. name
   2. e-mail address
   3. date of birth
   4. other information input by users in the form specifies by the Company

The user's permission must be obtained before collecting the following User's Information:

1. Terminal information: and
2. Location information.

If the user specifies a certain setting, the user is entitled to require the Company to, and the Company shall immediately, discontinue the use of any or all of the User's Information, in accordance with such rules as may be from time to time prescribed by the Company. Depending on the item of the User's Information, if such collection or use is required for the Services, the Company may not be able to discontinue such collection unless the user withdraws from the Services pursuant to the procedures as determined by the Company.

5 Outside Transmissions; Provision to Third Parties: Information Collection Modules In order to distribute targeted advertisements using the Users Information, the following information collection module is incorporated into the Services. Thus, the Company provides the User's Information to the provider of such information collection module in accordance with the following:

1. Name of Information Collection Module:
2. Provider of Information Collection Module:
3. Items of User's Information to be Provided
4. Means and the Methods of Provision
5. Purposes of Use by Provider:
6. Whether or not Provider Intends to Provide Information to Third Parties:
7. URL of Providers Privacy Policy

Unless required by the related Personal Information Protection Act or other applicable laws and regulations, the Company shall not provide to any third party personal information contained in the User's Information without the prior consent of the user, unless:

1. The Company authorizes such third party to handle the personal information in whole or in part to the extent necessary to accomplish the purpose of the use:
2. The personal information is provided through a business transfer by way of merger or other similar transactions:
3. The personal information is provided to a provider of an information collection module pursuant to Section 4 hereof:
4. The Company is required to cooperate with state or local governmental organizations or their agents to perform their duties or obligations pursuant to applicable laws and regulations, and such performance is likely to be precluded if the consent of the user must be obtained: and
5. In addition to the foregoing, the Company is entitled to disclose information pursuant to the Personal Information Protection Act or other applicable laws and regulations.

The Company may jointly use personal information as follows:

1. Items of Personal Information to be Jointly Used;
2. Party to Jointly Use Personal Information;
3. Purposes of Joint Use;
4. Name of Party Responsible for User's Information.

Upon request from the user to disclose its personal information under the Personal Information Protection Act, the Company shall, without delay, disclose to the user such information after confirming its identity (or notify it of the nonexistence of such personal information), to the extent required to do so pursuant to the Personal Information Protection Act and other applicable laws and regulations.

1. Persons/Organizations required under law or in response to government requests;
2. Related, subsidiaries, holdings of Welpay, including future entities under Welpay;
3. Government agencies, statutory authorities, enforcement agencies under law;
4. Auditors, accountants, lawyers under Welpay;
5. Contractors, sub-contractors, affiliates of Welpay;
6. Third party service /product providers that is deem necessary or appropriate for the purposes stated above (including those located out of Malaysia, under conditions of confidentiality and similar levels of security);
7. Persons under a duty of confidentiality to the Welpay;
8. Any other purpose that we deem necessary and/or as required or permitted by any law, regulations, guidelines and/or relevant regulatory authorities.

Data shared will be for the purpose as stated in this notice, or purposes not stated but directly related to the primary purpose of collection. We may also share your Personal Data where required by law or where disclosure is necessary to comply with applicable laws, legal processes or queries from the relevant authorities.

We take necessary steps to store and process your personal data securely. Our security measures include:

1. Implementation of a formal information security policy and necessary technology controls such as firewalls, password controls, physical security, logging, and monitoring;
2. Process controls such as segregation of duties, defined roles and responsibilities, and need-to-know basis for staff;
3. Ensuring third-party providers and contractors storing or processing personal data implement similar acceptable security standards.

Your personal data will be stored only for the period necessary to fulfill the stated purposes, after which we ensure it is destroyed, anonymized, or permanently deleted if no longer needed. We may continue to store your information after fulfilling the primary purposes to:

1. Satisfy legal, regulatory, or accounting requirements;
2. Comply with other applicable laws and regulations.

We may use your personal data to provide you with information about our and third party services and/or products, which may be related to your interests, unless requested otherwise by you.

We may, in some circumstances, disclose your personal data to preferred merchants and strategic partners. Such disclosure will only occur where you have subscribed for particular Services or Products which require such disclosure, and/or where your consent has been obtained, subject at all times to any laws (including regulations, guidelines and/or obligations) applicable to [Company]. We take reasonable steps to ensure that the 3rd parties we are sharing your personal data with also have appropriate privacy and confidentiality obligations.

If you do not wish your personal data to be utilised for the purposes of marketing and promotion, please contact us at the contact details below. Your latest written instructions to us will prevail.

Under PDPA, you reserve the right to access your personal data and request for correction of the personal data that might be inaccurate, obsolete, incomplete or misleading.

In respect to this, you may:

1. Request to check and access your personal data in our records;
2. Request that we correct any of your inaccurate, obsolete, incomplete or misleading personal data;
3. Request copies of the data from us.

Once we receive a request, we will acknowledge the receipt of such request. For data amendment and correction, we will consider if the information requires amendment. If there is any disagreement, then we specify the reason in clearly stated terms such as where rights of others will be violated, or regulatory functions will be affected.

In accordance with the PDPA, and to the extent not limited by any other applicable law, we may:

1. Charge an administration fee for processing your request for access or correction to the Personal Data, in compliance to the fees stated in PDPA sub-regulation; and
2. Refuse to comply with your request for access or correction to the Personal Information and give you a written reason for such an action.