Privacy Notice

1. About Us

Quality Houses Public Company Limited (The Company) conduct business in real estate development which are recognized by both domestic and international customers.

2. Personal Data the Company Collects From You

Personal data is information relating to an individual that makes it possible to directly or indirectly identify the data subject; however, it does not include the data of the deceased and anonymous data.

The Company will collect, use or disclose your personal data received from you, or from other reliable sources such as government agencies, business partner, affiliated companies. The personal data being collected is listed as follows;

• Identity Data refers to data that can identify you either directly or indirectly; such as name, surname, date/month/year of birth, gender, national identity card number, driver's license number, passport number, marital status, and etc.
• Contact Data such as address, email, and phone number.
• Sensitive Data such as race, beliefs, religion, health information, biometric data, criminal history, and etc. However, the Company will not process any types of sensitive data.
• Financial and Transaction Data such as bank account number, credit card and debit card number, monthly income data, payment information, and etc.
• Technical and Usage Data such as IP address, website browsing data from Cookie ID, device type, settings, and other platforms and technologies used to access our website.
• Profile Data such as username and password for online repair notification, sale of land, job application, interests, preferences, budget, reasons of purchase, and opinions from survey responses.
• Marketing and Communication Data such as your preferences in receiving marketing information from the Company and third parties; including contact information such as a tape recorder in the event that you contacted the Company via Call Center or through other social media channels, and etc.

Furthermore, the Company collect, use and disclose aggregated data, such as statistical data that cannot be used to identify a specific individual, such as data to calculate the rate of people who access our website, or to create statistical data. If the data is then able to be used to identify a specific individual, it will be considered as personal data and will be treated in accordance with this Privacy Notice.

Third-Party Links

This Privacy Notice coverage will end when you click a link to another website, as it is considered that you have ended your visit on our website. In the event that other websites collect, use or disclose your personal data, we encourage you to read the privacy notice of all the websites you visit for the benefit of your privacy.

3. Lawful Basis of Personal Data Processing

The Company will process your personal in accordance with the law as follows;

Consent

The company will process your personal data for the purposes stated and with your explicit consent.

Contract

The Company will collect, use, and process your personal data when it is necessary for the performance of a contract to which you are a party of, or to response to your request prior to enter into a contract, such as providing a service, proceeding with our internal processes to achieve contract performance objectives, and etc.

Legal Obligation

The Company processes data on a reasonable basis in order to comply with the law, such as preventing and detecting anomalies of transactions that may lead to illegal activities, reporting personal data to government agencies as required by law.

Public Interest

In some cases, it may be necessary for the Company to process personal data for the public benefit, or perform duties as assigned by a government agency.

Legitimate Interest

• The Company processes personal data for legitimate interests, such as for internal management which include the disclosure of data within the same business group to raise the standard of work of the Company; such disclosure will be in accordance with the Company's Privacy Policy and this Privacy Notice.
• To prevent and reduce the risk of illegal activities, including security camera recording in the project area or other areas, to uphold the security of residents.
• To maintain customer relations, such as complaints handling, offering benefits without a marketing objective, and etc.

Purposes of Personal Data Collection, Store, Use or Disclosure

The company collects, uses and discloses your personal data for the following objectives;

• To make the transaction as you have requested, the Company will collect your personal data such as your name, surname, email address, telephone number, opinions or inquiries, that you provided when you register through the Company's website or via other channels such as filling out questionnaires when you visit the project, when you contact the Company and request for further information
• To improve and develop services
• To perform a contract with a contractor that the Company hires or uses
• To comply with all relevant laws and regulations, and/or for any other benefits that you have given your consent to

In the event that you are an external service provider (Supplier/Outsource/Service Provider), the Company collect, use or disclose your personal data for the purpose of entering into a contract, procurement, check the quality of the products or services, or to evaluate the performance of the service provider.

The Company will collect, use, or disclose personal data on lawful basis which may varies depending on the purposes for which the data was processed for.

Marketing

Your personal data may be used for marketing and advertising, we have mechanisms to protect your personal data as follows:

Promotion Offer

We may use your identity data, contact data, technical and usage data and profile data to analyze and offer you suitable products or services; which include sending newsletter, offering various benefits and promotions.

You can choose not to receive marketing information through various channels, please see the details in “Opting Out” section below.

Opting Out

You can choose not to receive marketing news from us, via sending an email to DPO@qh.co.th. This cancellation will not affect our provision of products or services to you, or any other transaction you have with the Company.

Cookies

Our website stores cookies, for the purpose of improving the website service, and to create profile data about of your visit to our website without accessing your hard drive.

You can manage the cookies function in your browser's settings; for example you can choose to turn off certain types of cookies according to your preference. If you would like to know how to manage cookies functions, please access to the help menu in your browser. Turning off the cookie function may affect your ability to make certain transaction, use functions, and access to some content on our website.

Disclosure of Personal Data

In order to improve the quality of service and/or to use as a channel to offer products or services, inform news and various benefits, send event invitation, share marketing information and/or promotional programs of products or services, the Company may disclose your personal data to affiliate companies

Other than the detail specified in the first paragraph, the Company has no policy to sell your personal data to third parties. Your personal data will be kept confidential and we will not disclose your personal data unless necessary to achieve the objectives as notified to you as detailed above, or unless we received your consent; we may disclose your personal data to the following individuals or entities:

• External service provider (Supplier/Outsource/Service Provider) such as agents, partners, contractors, financial institutions, cloud computing service providers, marketing activities contractors, information technology development company; which may be both domestic and international. Other individuals or entities to which we disclose personal data to can only be collected and used for the purposes stated in the agreement.
• Government agencies or regulators, to comply with the law or in accordance with the orders of the authorities.

4. Security Measures for Personal Data

We have strict measures for the security of your personal data, with respect to your privacy which include taking action according to the law as follows;

• Categorize your personal data as confidential.
• Establish organizational and technical measures to prevent wiretapping, forgeries, unauthorized access or usage, such as information security, customer confidentiality policy, and etc.
• Our employees, employees and third-party service providers (Supplier/Outsource/Service Provider) are obliged to maintain the confidentiality of the customer's personal data in non-disclosure agreement that is signed with us.
• Establish procedures to handle any data breach incident, and will notify you if your personal data has been breached. The actions will be in accordance with the law.

However, the transmission of data via the internet still has limitations in the maintenance of security, despite our strict information security measures. Therefore, the Company cannot guarantee the security of the personal data you disclose through online channels. Thus, we are not responsible for any damage or loss incurred either directly or indirectly from unauthorized access to the personal data that you provide on our websites, unless we are proven of negligence.

5. Personal Data Retention

The Company will retain your personal data for as long as necessary to achieve the purposes for which we have collected it for. If you have ended your business relationship with us, we will retain your personal data in accordance with the Company's Privacy Policy, for a period of at least 10 years, or as required by law, in order to ensure the provision of products or services to you, and for legal purposes. However, at the end of the said period, the Company will destroy your personal data.

6. Data Subject Rights

You have rights under the Personal Data Protection law that you should be aware of. You can make a request by using the contact channel provided in the section “7. Contact Us.” We will process your request as soon as possible, which may take up to 30 days or more, depending on the volume and complexity of the request.

Right to Withdraw Consent

You have the right to withdraw your consent granted to us for the collection, use, or disclosure of your personal data. The Company will stop the processing of your personal data as soon as possible and may delete your personal data unless the Company is required to take further action that is required by law.

Right to Access

You have the right to request and obtain a copy of your personal data, or request the Company to disclose the obtained personal data. The Company will process your request within 30 days from the date we received the request.

Right to Rectification

You have the right to request us to make corrective action to ensure that your personal data is accurate, current, complete, and not misleading.

Right to Data Portability

You have the right to receive your personal data and request the Company to send or transfer your personal data to another data controller, or to obtain information that we have transmitted or transferred directly to another data controller.

Right to Erasure

You have the right to request the Company to delete, destroy, or turn your personal data into non-personally identifiable information in the following events:

• When such personal data is no longer necessary for the purpose of the data is being collected or processed for.
• You withdraw your consent to process personal data and the Company has no lawful basis to process it.
• You have objected to the processing activity such as direct marketing purposes.
• The personal data is unlawfully processed.
• Data subject object the processing activities (other than objection of processing activities for direct marketing purposes) and we cannot further process based on legitimate interest.

If such event occurred, the Company shall delete, dispose, or anonymize the personal data without delay. If the Company disclose personal data to the public, the Company shall notify other data controller regarding data subject request to exercise right to erasure for them to delete such personal data.

Nonetheless, the Company can reject the request of data subject, if it is proven that such processing activities have the following necessities;

1. The Company can demonstrates higher legitimate ground.
2. The personal data is involved in establishing legal claims, legal compliance, exercise of legal rights, or defense of legal claims.
3. The personal data is processed to exercise freedom of expression.
4. The personal data is processed to achieve the objectives related to the preparation of historical documents, research, or statistics for the public interest; and the personal data is secured with appropriate safeguards to protect the rights and freedoms of data subjects.
5. The personal data is processed for public tasks or comply with authorized government agencies’ orders.

Right to Restriction of Processing

You have the right to restrict the processing of your personal data when the following conditions are met;

• When there is no longer a need for processing activities, but the retention of personal data is necessary for legal claims.
• When there is an unlawful processing activities of personal data. However, the data subject would like to prohibit the processing instead of erasing or deleting their personal data.
• When the personal data being verified for accuracy as you have requested.
• When the personal data is in the process of proving reasons of higher legitimate grounds.

Right to Object

You have the right to object the collection, use, or disclosure of personal data in the following events;

• In the event that personal data is collected, used, or disclosed for the purpose of direct marketing.
• In the event that the processing of personal data is for the purposes of scientific, historical, or statistical research; unless it is necessary for the performance of public interest.
• In the event that the personal data is collected for public interest or for a legitimate interest; unless the Company can prove higher legitimate ground.

Right to Lodge a Complaint

You have the right to lodge a complaint to relevant government agencies, in the event that the Company, the employee, or the contractor of the Company violates or fails to comply with Thai Personal Data Protection Act.

7. Contact Us

You can request to exercise your rights as data subject, and if you have any question or complaint, you can contact the Company via the following channels;

• Quality Houses Public Company Limited
• Location: Q House Lumpini Building, 7th Floor, 1, South Satorn Road, Kwaeng Thung Maha Mek, Khet Sathon, Bangkok
• Email: DPO@qh.co.th