This Policy applies to the personal data of individuals who have relationships with the Company, both present and future, which are processed by the Company, its officials, contracted employees, business units or other entities operated by KANEKOJI, and including contractors or third parties that process personal data on or on behalf of KANEKOJI (“Data Processors”) under various products and services, such as websites, systems, applications, documents, or other services that are controlled by KANEKOJI (collectively referred to as “Services”).

Individuals who have relationships with KANEKOJI in accordance with the first paragraph include:

(1) to (6) are collectively referred to as “You”
In addition to this Policy, KANEKOJI may establish a Privacy Notice (“Notice”) for KANEKOJI products or services to clarify to the data subject who is a service user about the personal data that is processed, the purpose and lawful basis for the processing, the period for which personal data is retained, and the data subject’s rights in that specific product or service.
In the event of a conflict in substance between the Privacy Notice and this Policy, the Privacy Notice of that service shall prevail.

KANEKOJI collects or obtains various types of personal data from the following sources:

This section specifies the specific requirements that apply to KANEKOJI's processing of data that is conducted through KANEKOJI Store only.

If data subjects refuse to provide data that is necessary for KANEKOJI's services, KANEKOJI may not be able to provide such services to such data subjects in whole or in part.

KANEKOJI considers the legal basis for collecting your personal data in a manner that is appropriate and in the context of the services provided. The legal bases for collecting personal data that KANEKOJI uses include:

Legal basis for collecting data	Details
For the purpose of carrying out a public task or using state power granted to KANEKOJI	In order for KANEKOJI to exercise state power and carry out public tasks in accordance with its mission, as prescribed by law, such as: - The Royal Decree establishing the Digital Government Development Agency (Public Organization) B.E. 2561 - The Public Administration and Digital Government Service Act B.E. 2562 - Relevant rules, regulations, orders, and cabinet resolutions
For the purpose of fulfilling legal obligations	In order for KANEKOJI to comply with the laws that govern KANEKOJI, such as: - Collecting computer traffic data under the Computer Crime Act B.E. 2560 - The Public Information Act B.E. 2540 - The Public Organization Act B.E. 2542 - Tax laws - Carrying out court orders, etc.
For legitimate interests	For the legitimate interests of KANEKOJI and other individuals, where such interests are no less important than the fundamental rights of the data subject in his or her personal data, such as for the security of KANEKOJI's premises or the processing of personal data for KANEKOJI's internal affairs, etc.
For the prevention or mitigation of harm to the life, body, or health of an individual	This is a legal basis for collecting personal data under the Personal Data Protection Act (PDPA) of Thailand. This legal basis allows a company or organization to collect personal data that is necessary to prevent or mitigate harm to the life, body, or health of an individual. For example, a company may collect personal data to track the spread of a disease or to provide medical care to an injured person.
For contractual obligations	In order for KANEKOJI to perform its contractual obligations or to take necessary actions to enter into a contract with you, such as employment, service contracts, memorandums of understanding, or other types of contracts, etc.
Your consent	In order to collect, use, or disclose your personal data, KANEKOJI Company needs your consent. We will notify you of the purpose of collecting, using, or disclosing your personal data before requesting your consent. For example, we may need your consent to collect sensitive personal data for a purpose that is not in accordance with the exceptions in Section 24 or 26 of the Personal Data Protection Act B.E. 2562, or to promote or market products and services of our business partners to you.

In cases where KANEKOJI Company needs to collect your personal data to fulfill a contract, perform a legal obligation, or for the necessity of entering into a contract, if you refuse to provide your personal data or object to the processing of your personal data for the purpose of the activity, it may result in KANEKOJI Company being unable to perform or provide the services you requested in whole or in part.

KANEKOJI Company may collect or obtain the following information, which may include your personal data, depending on the services you use or the context of your relationship with KANEKOJI Company, as well as other considerations that affect the collection of personal data. The types of data listed below are only a general framework for KANEKOJI Company's collection of personal data. Only the data that is relevant to the products or services you use or have a relationship with will be applicable.

Type of personal data	Details
Personal information	Personal information that identifies you, including your name, surname, middle name, nickname, signature, national identification number, nationality, driver's license number, passport number, home address, business registration number, professional license number (for each profession), social security number, etc.
Personal information that describes you	Personal information that describes you, including your date of birth, gender, height, weight, age, marital status, military service status, photograph, spoken languages, behavioral data, interests, bankruptcy information, and information on whether you are incapacitated or quasi-incapacitated, etc.
Contact information	Contact information, including your home phone number, mobile phone number, fax number, email address, home mailing address, social media username (Line ID, MS Teams), and location map of your residence, etc.
Information about your use of KANEKOJI Company's products and services	Information about your use of KANEKOJI Company's products and services, including your user account name, password, PIN number, Single Sign-on (SSO ID) information, OTP code, computer traffic data, geolocation data, photos, videos, audio recordings, usage behavior data (from websites owned and operated by KANEKOJI Company, such as www.KANEKOJI.com or various applications), browsing history, cookies or similar technologies, device ID, device type, connection details, browser information, language used, operating system used, etc.

KANEKOJI Company collects and uses cookies and other similar technologies on websites under the control of KANEKOJI Company, such as www.KANEKOJI.com, or on your device depending on the service you use. This is to ensure the security of KANEKOJI Company's services and to provide you with a convenient and enjoyable experience using KANEKOJI Company's services. This information will also be used to improve KANEKOJI Company's website to better meet your needs. You can set or delete cookie usage in your web browser settings.

If KANEKOJI Company learns that personal data that requires consent to collect belongs to a minor, incapacitated, or quasi-incapacitated individual, KANEKOJI Company will not collect such personal data until it has obtained the consent of the legal guardian who is authorized to act on behalf of the minor, or the guardian, or the trustee, as applicable. This is in accordance with the conditions set forth by the law.

If KANEKOJI Company is not aware in advance that the data subject is a minor, incapacitated, or quasi-incapacitated individual, and then later finds that KANEKOJI Company has collected data from such data subject without the consent of the legal guardian who is authorized to act on behalf of the minor, or the guardian, or the trustee, as applicable, then KANEKOJI Company will delete such personal data promptly if KANEKOJI Company has no other legal grounds for collecting, using, or disclosing such data other than consent.

Under the purposes stated in Article 9 above, KANEKOJI Company may disclose your personal data to the following persons. However, the types of recipients of information listed below are only a general framework for KANEKOJI Company's disclosure of personal data. Only the recipients of information that are relevant to the products or services you use will apply.

Type of recipient	Details
Government agencies or authorities to which KANEKOJI Company must disclose information for the purpose of legal action or other important purposes (such as public interest actions)	Agencies that enforce the law, have regulatory authority, or have other important objectives, such as the Council of Ministers, acting ministers, the Department of Provincial Administration, the Department of Revenue, the Royal Thai Police, the courts, the Office of the Attorney General, the Department of Disease Control, the Ministry of Digital Economy and Society, the Office of the Prime Minister's Secretariat, the Department of Consular Affairs, and the Student Loan Fund, etc.
The committees that are responsible for ensuring that the company complies with laws and regulations.	KANEKOJI may disclose your information to individuals serving on various committees, such as the Recruitment Sub-Committee and the Digital Government Development Committee, as necessary to comply with applicable laws and regulations
Business Partners	KANEKOJI may disclose your information to third parties that work with KANEKOJI to provide services to you, such as service providers that you contact through KANEKOJI's services, marketing and advertising providers, financial institutions, platform providers, and telecommunications providers.
Employees within the company	KANEKOJI may disclose your information to employees within the company who work in departments that need to know the information, such as the accounting department, customer service department, marketing department, and legal department.
Service Providers	KANEKOJI may appoint third-party service providers to represent or support the company's operations. These service providers may include data storage providers (such as cloud document warehouses), system developers, software and application developers, document delivery services, payment processors, internet service providers, telecommunications providers, digital ID providers, online social media platforms, risk management consultants, external consultants, and transportation service providers, among others.
Public Disclosure of Information	KANEKOJI may disclose your information to the public when necessary, as required by official regulations, such as when mandated by a royal decree or a ministerial resolution, or in compliance with other legal obligations imposed on the company

KANEKOJI will retain your personal data for as long as it is necessary for the purposes for which the data was collected, as specified in our policies, announcements, or relevant laws and regulations. Once the data is no longer necessary for the aforementioned purposes, KANEKOJI will delete or destroy your personal data or render it unidentifiable according to the methods and standards of data deletion and destruction that may be prescribed by the committee or the law or international standards.

In cases of disputes, the exercise of rights, or legal proceedings related to your personal data, KANEKOJI reserves the right to retain such data until the dispute is resolved or until a final order or judgment is issued.

KANEKOJI may appoint or contract with third parties (data processors) to process personal data on behalf of the company. These third parties may offer services in various capacities, such as hosting, outsourcing, cloud computing services, or other forms of data processing. When appointing third parties as data processors, KANEKOJI will establish agreements specifying the rights and responsibilities of KANEKOJI as the data controller and the data processor. This includes defining the types of personal data that KANEKOJI assigned for processing, as well as the purposes and scope of the data processing. Data processors are obligated to process personal data only within the defined scope of the agreement and in accordance with KANEKOJI's instructions, without engaging in any further processing for other purposes.

In cases where data processors engage sub-processors to process personal data on their behalf, KANEKOJI will ensure that there are contractual agreements in place between the data processor and the sub-processor that meet standards not less than those set forth in the agreement between KANEKOJI and the data processor.

KANEKOJI has implemented data protection measures by restricting access to personal data to only authorized personnel or individuals who have a necessary and legitimate purpose for accessing such data, as specified by the data owner. These authorized individuals are required to adhere to and diligently follow KANEKOJI's data protection policies, as well as maintain the confidentiality of personal data they come into contact with. KANEKOJI has established security measures, both organizational and technical, that adhere to international standards to ensure the security of data as required by the Personal Data Protection Committee or applicable laws.

Additionally, when KANEKOJI shares, transfers, or discloses personal data to third parties, whether for the purpose of fulfilling obligations under contracts or agreements, or in any other format, the company will establish appropriate security measures and confidentiality safeguards in accordance with legal requirements. This is done to ensure that the personal data collected and maintained by KANEKOJI remains secure at all times.

KANEKOJI's services may connect to external websites or services provided by third parties. These external websites or services may have data protection policies that differ from the policies outlined here. KANEKOJI recommends that you review the data protection policy of these external websites or services to understand the details before using them. Please note that KANEKOJI has no control over and cannot assume responsibility for the content, policies, damages, or actions arising from external websites or services provided by third parties.

KANEKOJI has appointed a Data Protection Officer (DPO) to oversee and provide guidance on data collection, usage, and disclosure. The DPO is responsible for ensuring compliance with the Personal Data Protection Act of 2019 and collaborates with the Office of the Data Protection Committee to ensure alignment with the legal requirements.

The Personal Data Protection Act B.E. 2562 (PDPA) provides several rights for data subjects. These rights will come into effect when the relevant provisions of the PDPA come into effect. The details of these rights are as follows:

Non-compliance with the policy may result in disciplinary action under KANEKOJI's rules and regulations (for KANEKOJI's employees or operators) or under the data processing agreement (for data processors). Depending on the case and your relationship with KANEKOJI, you may also be subject to the penalties specified in the PDPA and its subsidiary laws, rules, regulations, and orders.

If you find that KANEKOJI has not complied with the Personal Data Protection Act, you have the right to file a complaint with the Personal Data Protection Commission (PDPC) or another competent authority appointed by the PDPC or by law. However, before filing a complaint, KANEKOJI asks that you please contact KANEKOJI first so that KANEKOJI can have the opportunity to investigate the matter and provide clarification.

KANEKOJI may consider revising, amending, or making changes to this policy as deemed necessary. Notification of the effective date for each revised version will be communicated through the website www.KANEKOJI.com. However, we recommend that you regularly review the updated policy, either through our application or specialized channels managed by KANEKOJI, particularly before disclosing personal data to KANEKOJI

By accessing KANEKOJI's products or services after the enforcement of the new policy, you are deemed to have acknowledged and accepted the terms outlined in the updated policy. Please discontinue the use of our services if you do not agree with the details in this policy and kindly reach out to KANEKOJI for further clarification.

If you have any questions, suggestions, or concerns regarding the collection, use, and disclosure of personal data by KANEKOJI, or related to this policy, or if you wish to exercise your rights under data protection laws, please feel free to contact