Privacy Notice
For Customer-Related Processes of The Secret Farm Co., Ltd.
General Provisions
To comply with the Personal Data Protection Act B.E. 2562 (2019), relevant subordinate legislation, and any future amendments thereto (collectively referred to as the “Personal Data Protection Law”), The Secret Farm Co., Ltd. (the “Company”) has issued this Privacy Notice to inform you of how the Company processes personal data that can directly or indirectly identify you (“Personal Data”). This includes collection, use, disclosure, or any other processing of personal data by automatic means or otherwise, such as recording, organizing, storing, modifying, retrieving, transmitting, disseminating, aligning, combining, restricting, deleting, or destroying (collectively referred to as “Processing”).
This Notice also describes the purposes of processing, the retention period of personal data, and your rights as the data subject. The Company recommends that you thoroughly read and understand the provisions of this Privacy Notice as detailed below.
Categories of Individuals Whose Personal Data Is Collected
This Privacy Notice applies to the collection and processing of Personal Data from the following individuals:
- Customers: Individuals who purchase products or use the Company’s services, including potential customers, participants in marketing activities, seminars, auctions, users of the Company’s website or applications, information seekers, and survey respondents related to the Company’s products and services.
- Related Persons to Customers: Persons affiliated with or representing the customer, such as executives, directors, employees, representatives, or personnel of a corporate customer. This also includes individuals whose personal data appear in related documents, e.g., managers, purchasers, recipients, and payment processors.
Methods of Data Collection
The Company may collect your Personal Data through the following means:
- Direct Collection:
- When you contact or interact with the Company through written, verbal, electronic, or in-person communications.
- When you express intention to purchase or receive services or enter into contracts with the Company.
- When participating in marketing events, lucky draws, or company-sponsored activities.
- When you contact or interact with the Company through written, verbal, electronic, or in-person communications.
- Automated Collection:
- Through cookies or similar technologies during website or app usage.
- Through cookies or similar technologies during website or app usage.
- Third-Party Sources:
- From service providers, business directories, or publicly accessible sources.
- From service providers, business directories, or publicly accessible sources.
You will be informed of the relevant details, including the purpose and legal basis of data processing. In cases where your consent is legally required, the Company will explicitly request it.
Types of Personal Data Collected
Personal Data that the Company collects and processes may include:
- Identification Information: Name, surname, nickname, date of birth, ID number, photo, signature.
- Contact Information: Address, phone number, email, Line ID.
- Business Information: Type of business, company/office details, vehicle information.
- Financial Information: Account numbers, invoices, tax documents, receipts.
- Verification Documents: Copies of ID, passport, household registration, licenses, certificates, contracts, title deeds.
- Technical Information: IP address, logs, cookies.
- Other: Audio recordings, CCTV footage.
Purposes and Legal Bases for Processing
The Company processes Personal Data for the following purposes, based on various legal grounds:
- Auction Participation: For qualification review, communication, and contract execution.
- Legal Basis: Legitimate Interest, Contract.
- Legal Basis: Legitimate Interest, Contract.
- Contractual Engagements: For executing agreements and collateral arrangements.
- Legal Basis: Contract, Legitimate Interest.
- Legal Basis: Contract, Legitimate Interest.
- Order Management: Processing and verifying orders.
- Legal Basis: Contract, Legitimate Interest.
- Legal Basis: Contract, Legitimate Interest.
- Service Delivery: Including billing and delivery.
- Legal Basis: Contract, Legitimate Interest.
- Legal Basis: Contract, Legitimate Interest.
- Customer Record Updates: To ensure current and accurate data.
- Legal Basis: Legitimate Interest.
- Legal Basis: Legitimate Interest.
- Complaint Handling: Receiving and resolving complaints.
- Legal Basis: Legitimate Interest.
- Legal Basis: Legitimate Interest.
- Marketing Activities: Communications, photos, event promotions.
- Legal Basis: Consent.
- Legal Basis: Consent.
- Usage Analysis: Website and app usage for service improvement.
- Legal Basis: Legitimate Interest, Consent.
- Legal Basis: Legitimate Interest, Consent.
- Communication: Responding to queries or requests.
- Legal Basis: Legitimate Interest.
- Legal Basis: Legitimate Interest.
- Legal Compliance: With tax, data protection, and other laws.
- Legal Basis: Legal Obligation.
- Legal Basis: Legal Obligation.
- Legal Claims: Establishing, exercising, or defending legal claims.
- Legal Basis: Legitimate Interest.
- Legal Basis: Legitimate Interest.
- Security: Safety of persons and property via CCTV.
- Legal Basis: Legitimate Interest, Vital Interest.
- Legal Basis: Legitimate Interest, Vital Interest.
- Other Necessary Actions: Related to the purposes listed above.
- Legal Basis: Legitimate Interest, Consent.
- Legal Basis: Legitimate Interest, Consent.
- Additional Purposes: As will be further communicated.
- Legal Basis: Consent (as required by law).
- Legal Basis: Consent (as required by law).
Data Disclosure
The Company may disclose your data to:
- SRC Group companies (local and international).
- Business partners and service providers.
- Company advisors (legal, financial, etc.).
- Government agencies as required by law.
- Any third party authorized by your consent.
Disclosures are conducted within legal frameworks with adequate data protection measures in place, including for international transfers.
Retention Period
Personal Data will be retained for as long as necessary to fulfill the purposes outlined, not exceeding 5 years after termination of the relationship, unless otherwise required by law or necessary for legal claims.
After the retention period, data will be securely deleted or anonymized unless continued retention is legally permissible.
Your Rights as a Data Subject
You are entitled to:
- Access your data.
- Request data portability.
- Object to processing.
- Request data erasure.
- Restrict processing.
- Rectify inaccurate data.
- Withdraw consent at any time.
- Lodge complaints with the data protection authority.
Requests can be submitted using the contact information below. The Company reserves the right to assess and act on such requests in accordance with applicable laws.
Contact Information
Data Protection Officer (DPO)
Email: farmer@thesecretfarm.com
Address: 1679/2 Town in Town Soi 11, Ladprao 94 (Panjamit), Phlabphla, Wang Thonglang, Bangkok 10310
Amendments to this Notice
The Company may amend this Privacy Notice to reflect changes in data processing or legal requirements. Important changes will be notified through appropriate channels. You are encouraged to review this notice periodically.
Effective Date: June 1, 2023