Last Updated: 15 May 2023
- OVERVIEW
- Company. Zipmex Company Limited (hereinafter referred to as the ‘Company’) is a company incorporated in Thailand under the laws of Thailand which operates the website https://www.zipmex.co.th (hereinafter referred to as the‘Website’) and/or any other platforms that the Company provides (hereinafter referred to as the‘Platforms’), dedicated to the transaction of digital assets and the provision of related services (hereinafter referred to as the ‘Services’). For convenience of wording in this Privacy Policy, the Company, this Website and/or the Platforms are referred to collectively as ‘we’ ‘us’ or ‘our’.
- You. All natural persons (a) that have submitted their personal data to us by contacting us via any communication channels; or logging on to this Website and/or the Platforms (including without limitation the visitor or the registered users of our Website and/or Platforms); (b) whose personal data have been shared with us for the use of the Website / Platforms and/or Services (including without limitation the legal representative or the relevant persons of the corporate user) shall be considered the data subject under Privacy Policy. For convenience of wording in this Privacy Policy, the data subjects are referred to as ‘you’ or ‘your’.
- Personal Data. ‘Personal data’ means any information relating to an identifiable living individual, in particular the data subject, who can be identified from that data or from that data and other data or any other data that are defined as the ‘personal data’ under the relevant laws and regulations, in particular the Personal Data Protection Act of Thailand and the subordinated legislatures.
- Acceptance of the Privacy Policy. To ensure that you have full confidence in our handling of your personal data, you are advised to read and understand our personal data protection policy, which is covered by this Privacy Policy (the “Privacy Policy”), in full and to periodically revisit this Privacy Policy to check for updates from time to time. In particular, by logging on to our Website and/or Platforms, regardless of whether you are registered with this Website and/or Platforms, you shall be deemed to confirm that you have read and understood this Privacy Policy.
- Third-Party Website. If you visit any of the links to third-party websites and/or platforms listed on this Website and/or the Platforms or any links of any of our third-party partners, the use of your personal data by the third party will be subject to a separate and independent privacy policy of such third-party websites and/or platforms where we cannot give any guarantee or representation on those process of your personal data.
- Language. This Privacy Policy is prepared in both English and Thai. In the event of any inconsistency, the English version shall prevail.
- Purposes of the Privacy Policy
- This Privacy Policy will help you understand our guidelines on protecting your personal data, and describe the rationale behind and our methods of collecting, utilizing, disclosing your personal data, as well as the cross-border transfer thereof and/or other processes involved (collectively referred to as “process”) of your personal data, and will also outline your rights in connection with such personal data as well as your options to protect such personal data when using our Services.
- The Privacy Policy stipulates the types of your personal data that we may collect through your logging on to and your registration with this Website and/or the Platforms, and/or your use of the Services we offer, as well as how we shall process and protect the personal data so collected.
- Personal Data Collected
- Sources of Personal Data. We may collect your personal data directly or indirectly from 3 main sources, including:
- Directly from you. When you contact us via several communication channels (online and offline); log on to this Website and/or the Platforms; register as the user on this Website and/or the Platforms; or use the Services offered or provided by us, we will collect and process your personal data.
- Sources of Personal Data. We may collect your personal data directly or indirectly from 3 main sources, including:
- In particular, in case that any corporate user provides the personal data of your relevant data subjects to us, we shall deem that upon the submission of those personal data, the relevant corporate user gives representation and warranty to us that we can process the personal data of those data subjects as provided pursuant to this Privacy Policy;
- Automatically by our system. When you visit or log on our Website and/or Platforms, our system will collect and process some of your online identifier (as defined below) automatically; and
- Indirectly from other sources. We may legitimately collect or obtain your personal data from the third-party sources, including government database or any other third-party service providers or business partners, social media or any other public data sources.
- Personal Data being collected: When you use this Website, Platforms and/or our Services, we would need to process the following personal data of yours for the purpose of performing our legal and contractual obligations as well as to exercise our legitimate rights and interests that we may have against you.
- The personal data that will be collected are defined as follows:
| Types of Personal Data | Details and Examples |
| Online Identifier | Information relating to the device or equipment that you may use to connect to the Website and/or Platforms, including IP address or Mac address, Cookies, Device ID, search and query track that you may execute on the Website and/or Platform, location data, version or plug-in browser, operating system or any other technical identifiers of you or your device. |
| Identity Data | Identity data can help us verify whether you are eligible to be registered as a member of this Website and/or the Platforms. It includes but is not limited to your name, residential address, mailing address, other certificates and corresponding numbers thereof that are issued by your country or government to certify your identity information, as well as all other information that can help us to verify your identity that we are obliged under the applicable laws (including without limitation the Anti-Money Laundering laws and the requirements of the supervisory authorities, Securities and Exchange Commission of Thailand) to collect in order to verify and validate your identity. |
| Sensitive Personal Data | Facial recognition and comparison information that you would be required to submit the live selfie and our system will compare such facial image with the biometric information contained in the national identification card or passport. |
| Contact Data | Current address, residential address, telephone number, email and other social media accounts. |
| Qualification Data | Educational and occupational information, suitability test result, risk acceptance level as assessed via our system and the AML/CFT risk profile as we would be obliged under the applicable laws to collect, assess and process prior to the acceptance of any customer (including without limitation KYC, CDD, FATCA and other risk assessments). |
| Financial Data | Bank account information, source of income and other proof of income (including without limitation payment slips). |
| Transaction Data | User account, user ID, login information, electronic signature and any other transactional information executed by you on the Website and/or the Platforms (including without limitation the order placement, digital assets and fiat delivery and settlement and other history information collected). |
| Other Data | Any other personal data that you have provided to us for participation in the event, for the complaint management, the feedback management, the contact-back process and any other personal data as specified in the form that we requested from you. |
- Additional Personal Data. When you use this Website and/or the Platforms or the Services, we may collect further personal data as required from our exclusive mailboxes or in other manners that we consider as being in compliance with relevant requirements, for the purpose of improving the functions of this Website and/or the Platforms, enhancing your experience of using this Website and/or the Platforms and its Services as well as the security thereof, or as is required by any court order, any applicable law, administrative regulation or any order of any other competent government agencies.
- Cookies. When you visit our Website and/or the Platforms, we use cookies to record our performance. Cookies are a small amount of data that is sent to your browser and stored on your computer’s hard drive. Only when you use your computer to access our Website and/or the Platforms can the cookies be sent to your computer’s hard drive.
- Most browsers are designed to accept cookies. You can opt to set your browser to reject cookies. However, if you set your browser to disable cookies, it is possible that you may not be able to launch or use some functions of our Website and/or the Platforms.
- Purposes of Personal Data PROCESSING
- We will process your personal data (as defined above) for the following purposes and relying on the following lawful basis:
- Contractual Basis where we are obligated to process your personal data to carry out any obligations or responsibilities that you are requesting from us or that we commit according to the terms and conditions of this Website and/or the Platforms to perform and provide to you, including in particular the following detailed purposes:
- to respond to your request for information and inputs relating to our Websites, the Platforms; and/or the Services that you have submitted through various communication channels;
- to verify your qualifications before being registered as our users pursuant to the terms and conditions defined; to identify and confirm your identity when you use our Website, the Platforms; and/or the Services; as well as to verify your qualification according to the defined terms and conditions for the VIP conditions;
- to provide you with our Services through our Website and/or the Platforms, including without limitation to coordinate and facilitate transactions as you may execute on the Website and/or the Platforms from order placement to settlement and delivery;
- to provide any additional services and contractual obligations that you may request from us or we may host and you may participate in, including without limitation any additional services that may be provided to the VIP customers according to the tier defined.
- Legal or regulatory obligations where we need to comply with the legal or regulatory obligations that we are subject to and we would then need to process your personal data to satisfy those obligations, including without limitation for the following detailed purposes:
- to complete your identity verification and validation through the know-your-customer and/or customer enhanced due diligence process (including the AML/CFT risk assessment and profiling) as we are obliged under the AML and other subordinated regulations to perform prior to the acceptance of you as our user;
- to monitor and report any required cash or digital assets transaction as well as any suspicious transactions to the AML authorities and to the supervisory authorities, in particular the Securities Exchange and Commission of Thailand;
- to proceed with the tax documentation and tax payment requirements as we may be obliged under the tax and accounting laws to perform;
- to perform any other personal data processing as instructed by the applicable laws, subordinated legislatures and order / judgment and/or instructions of the relevant government authorities.
- Legitimate Interests where we require your personal data to achieve our legitimate interest of running our business in some specific situations, provided your interests and fundamental rights and freedoms are not overridden, including without limitation to the following detailed purposes:
- to keep statistics relating to the use of our Website and/or the Platforms, and to be used for data analysis carried out for the improvement and upgrade of the Services of this Website and/or the Platforms;
- to personalize your experience; and to conduct user segmentation for the purpose of customization and improvement of our Services and/ or your journey on our Website and/or the Platforms;
- to monitor, detect and audit any fraud or any suspicious transaction executed on the Website and/or the Platforms pursuant to the risk management and market surveillance framework that we may set and define; and
- to manage any complaint or legal proceedings that you may have brought against us or we may need to enforce against you.
- Consent where you have provided, in certain cases, your consent for us to process your personal data for particular purposes, we will proceed accordingly. In particular, we will proceed with the following personal data processing with your consent:
- to process the biometric comparison data, in particular the facial recognition data, which is categorized as the sensitive personal data for the purpose of the identity verification as we are obliged under the applicable laws to perform; provided that it should be emphasized that in case you are not giving this specific consent, we may be obliged under applicable laws not to accept you as our customer;
- to contact you in connection with the products and services that you may be interested in and in particular to send you personalized marketing communications to ensure that you are always kept up-to-date with our latest products and services that suits your interests.
- Contractual Basis where we are obligated to process your personal data to carry out any obligations or responsibilities that you are requesting from us or that we commit according to the terms and conditions of this Website and/or the Platforms to perform and provide to you, including in particular the following detailed purposes:
- Effect in case you do not permit us to process the Personal Data as defined. In the case where you withhold any of your personal data from us to process in relation to the purposes prescribed in this Privacy Policy, you may not be able to utilize certain parts of our Services. In some instances, we may not be able to accept your registration for or for you to continue using our Services.
- We will process your personal data (as defined above) for the following purposes and relying on the following lawful basis:
- Retention Period for Personal Data
We will retain your personal data for as long as it is reasonably necessary to fulfill the purposes for which we have obtained your personal data as set out in this Privacy Policy (in particular so long as you remain the user of our Website, Platforms and/or Services), and to establish exercise or defense of legal claims (in particular throughout the prescription period as applicable that may last for a period of 10 years after the execution of each transaction between you and us). However, we may have to retain your personal data for a longer period, if required by any applicable laws.
- Disclosure of Personal Data
- To whom the Personal Data will be shared. We may disclose your personal data to the following parties:
- Affiliates or trusted third-party service providers (i) who help us operate this Website and/or the Platforms, manage our business, or provide the Services to you; (ii) when we believe that personal data disclosure is required to ensure the effectuation of the transaction and order that you make;
- Government authorities where we are obliged by any of the applicable laws, regulations, rules or by any order of courts or other competent authorities to disclose your personal data to, including in particular the AMLO, the Revenue Department and the Securities and Exchange Commission of Thailand;
- Any person that you give consent to us to disclose your personal data to
- Confidentiality Arrangement. For the case where your personal data is being disclosed to other third-parties, we will ensure the protection of your personal data, such as confidentiality arrangement, appropriate security measures to the extent as required by laws and we will only disclose your personal data on a necessary and need-to-know basis.
- Cross-border Transfer. For the purposes mentioned above in this Privacy Policy, we may disclose or transfer your personal data to third parties or servers located overseas which the destination countries may or may not have the same data protection standards as Thailand; provided that in all circumstances that your personal data will be shared abroad, we will take steps and measures to ensure that your personal data is securely transferred, that the data recipients have suitable data protection standards in place, and that the transfer is in compliance with the applicable laws.
- To whom the Personal Data will be shared. We may disclose your personal data to the following parties:
- Protection of Personal Data
- We adopt appropriate physical, electronic, management and technical measures so as to protect and safeguard the security of your personal data. We will, to the fullest extent possible, ensure that any personal data collected through our Website and/or the Platforms shall be free from being subject to nuisance by any third party unrelated to us. The security measures that we may take include but are not limited to:
- Physical measures: records of your personal data will be stored in an appropriately locked and secured premises.
- 7.2 Electronic measures: the computer data that contain your personal data will be stored in computer systems and storage medias that are subject to strict login restrictions.
7.3 Management measures: only staff members duly authorized by us can access your personal
data, and these staff members shall comply with our internal code concerning personal data
confidentiality.
- 7.4 Technical measures: such encryption techniques as Secure Socket Layer Encryption may be used to convey your personal data.
- 7.5 Other measures: our network servers are protected by proper ‘firewalls’.
- Your Rights
Subject to applicable laws and exceptions thereof, your personal data rights include:
- Right to Be Informed. You have the right to know the objectives of the processing, necessity to provide personal data and impact for not providing personal data when entering into a contract, retention period, the person the personal data will be transferred to and contact information of the data controller and DPO.
- 8.2 Right to Access. You have the right to request a copy of all your personal data we are processing about you, provided that there may be applicable fees at the rate approved by the relevant authority.
- 8.3 Right to Data Portability. For the case where we have an automated platform allowing you to access your personal data automatically: (i) you may have the right to ask for your personal data to be transferred automatically to other organizations; and (ii) you may have the right to ask for your personal data to be directly transferred to other organizations, with the exceptions of cases where there are technological limitations.
- 8.4 Right to Object. You have the right to object to any data processing activity of your personal data in certain circumstances that we may exercise our legitimate rights to process your personal data.
- 8.5 Right to Rectification. You have the right to edit your personal data to be correct and up to date.
- 8.6 Right to Erasure. You have the right to request the deletion or anonymization of the personal data that we process about you, in accordance with the following cases: (i) the personal data is no longer necessary for the processing purposes; (ii) once the consent has been withdrawn; (iii) you object to the processing of your personal data by us based on our legitimate interests, and we do not have overriding legitimate grounds for the processing; and (iv) the processing activity is not in accordance with the law.
- 8.7 Right to Restriction. You have the right to restrict any data processing activities in the following cases: (i) during the verification process in accordance with the rights request to update personal data; (ii) for cases related to personal data where initially there was a request for erasure, but this was followed by an additional request of processing restrictions instead; (iii) for cases when the data processing terms have ended, but you have requested further processing restrictions due to legal reasons; and (iv) during the process of personal data processing objection verification.
- 8.8 Right to Withdraw Consent. You have the right to withdraw your consent regarding the processing of your personal data at any time if such withdrawal is not restricted by law or any contract that provides benefits to you. It should be noted, for the avoidance of doubt, that in case you withdraw the consent given to us to process your facial recognition, we would be obliged to refuse and retain such personal data for the period of time as prescribed under applicable laws.
- 8.9 Right to Lodge a Complaint. You have the right to lodge a complaint with the competent authorities in the case that we act unlawfully or not in compliance with applicable laws in the processing of your personal data.
- Modification to the Privacy Policy
We reserve the right to amend the Privacy Policy from time to time and at any time. We will inform you of the modifications made to the Privacy Policy by informing the change thereof to you via email and publishing the effective date of the release of new versions hereof onto the Website and/or Platforms. When an updated version of this Privacy Policy is released, your continued visit to this Website and/or the Platforms shall indicate and show that you have read and understood the terms in the updated Privacy Policy.
- Communication with Us
- If you have any requests, comments, or wish to exercise your rights under the laws, you can contact us at 16BC Zone, Q House PhloenChit Building, 16th Floor, 598, PhloenChit Road, Lumpini Sub-district, Pathumwan district, Bangkok 10330, Thailand, or send an email to our Data Protection Officer at [email protected], which is the valid and official email through which we communicate with you.
If you have any questions regarding our Privacy Policy, you are welcome to contact us at any time.