Privacy Notice

Privacy Notice for Events

BSL Clinic Co., Ltd. (“the Company”) respects and values the privacy rights of event participants, registrants, trainees, and seminar attendees (“you”). The Company would like you to acknowledge and understand the purposes for which your personal data is processed in relation to the organization of events, exhibitions, trainings, and seminars, whether conducted online or offline (“Events”).

The Company is responsible for safeguarding your personal data under its supervision and is committed to managing such data in a secure, reliable, and trustworthy manner. Accordingly, the Company has issued this Privacy Notice for Events (“Notice”) to explain how it handles personal data and sensitive personal data, including details regarding the collection, use, disclosure, and purposes of processing, as well as to inform you of your rights. The details are as follows:

1. Types and Sources of Personal Data

The Company collects your information directly from you, which may be in the form of documents or electronic data. You may be requested to provide information by completing forms prepared by the Company or by filling in data through online platforms designated by the Company, and/or through other methods.

However, due to the nature of certain Events, the Company may need to process some of your information obtained from sources other than directly from you. The personal data collected from you may vary depending on the circumstances and the nature of the Event for which the Company needs to process your data.

• 1.1 General Personal Data
  
  • • 1.1.1 Personal details and membership information, such as name, surname, gender, date of birth, and signature.
  • • 1.1.2 Your achievements or contributions, such as opinions, suggestions, and reviews.
  • • 1.1.3 Social media account information and contact details, such as address, telephone number, and email address.
  • • 1.1.4 Audio, photographs, video recordings, and your comments during participation in the Event, including photos of the event atmosphere, group photos taken after the Event, and entry-exit records of the event venue, which may be collected from cameras or CCTV footage.
  • • 1.1.5 Other information, such as any documents used as evidence when contacting the Company, records of correspondence and communications if you contact the Company in any form, which may include images, audio, text conversations, and social media communications, as well as records of activities or events you have participated in or registered for.
  • • 1.1.6 Third-party personal data provided by you or obtained by the Company from third parties, such as personal data under items 1–5 above, for which you confirm to the Company that you have obtained consent from such persons to disclose their information to the Company.

• 1.2 Sensitive Personal Data

The Company does not intend to collect, use, or disclose your sensitive personal data. However, if such data appears on your national identification card, household registration, or other documents that you voluntarily disclose to the Company (e.g., race or religious information), and you provide any documents or media containing such data to the Company, you are advised to conceal such sensitive data yourself, for example, by crossing out such information.

If you do not conceal the sensitive data yourself, the Company will deem that you have given explicit consent for the Company to conceal such data on your behalf. In such cases, the documents you submit, once the sensitive data has been redacted by the Company, shall be considered complete and legally valid, and the Company may process them in accordance with the Personal Data Protection Act B.E. 2562 (2019).

In the event that the Company is unable to redact the sensitive data due to technical or other reasons, the Company will retain such sensitive data solely as part of your identity verification documents.

• 1.3 In Cases Where the Company Receives Your Personal Data from Third Parties

If the Company receives your personal data from third parties, clients of the Company, or other persons acting as data controllers or processors, the Company relies in good faith that such parties are entitled to process and disclose the personal data to the Company. This may include, but is not limited to, the following sources:

• 1.3.1 Social media platforms or third-party online platforms.

• 1.3.2 Third parties such as your affiliated company, parent, representative, employer, sponsor, service providers involved in providing services to you, distributors, external agents, or any persons acting on behalf of the data subject.

2. Purposes and Legal Bases for Processing Data

The Company processes data based on or referring to:
(1) the legal basis of consent for processing your data, (2) the legal basis of contractual performance for initiating, entering into, or performing a contract with you, (3) the legal basis of compliance with the Company’s legal obligations, (4) the legal basis of legitimate interests of the Company and of third parties, (5) the legal basis of preventing or suppressing danger to the life, body, or health of persons, and/or (6) the legal basis of public interest for performing missions for the public benefit or for the exercise of state authority, or other legal bases as prescribed by the Personal Data Protection Act, as the case may be. In this Notice, the Company will process your data separated by activities that the Company undertakes under the legal bases for processing personal data, as specified in this table.

3. Disclosure of Personal Data

• 3.1 The Company may disclose your sensitive personal data under the specified purposes and as permitted by law to the following persons and entities.

• 3.2 Affiliated companies, as listed on the website www.bslclinic.com, with which the Company has agreements. This shall include executives, directors, employees, staff, and/or internal personnel of such companies, only to the extent relevant and necessary for processing your personal data.

• 3.3 Service providers and personal data processors engaged or appointed by the Company to manage or process personal data on behalf of the Company in providing various services. This also includes those acting in the name of the Company or jointly with the Company to carry out the purposes specified in this Notice, where it is necessary to access your personal data. Examples include providers of information technology services, co-brand partners, product designers, sponsors, photographers, production houses, contractors engaged by the Company to produce media and organize events, or any other services that may benefit you or relate to the Company’s business operations, where it is reasonably necessary to disclose your personal data to achieve the Company’s business purposes.

4. Transfer of Personal Data Abroad

The Company may store your data on computer servers or clouds provided by third parties and may use third-party software or applications in the form of software-as-a-service or platform-as-a-service for processing your personal data. However, the Company will not allow unrelated persons to access personal data and will require such third parties to implement appropriate security protection measures.

In cases where the Company transfers or sends your personal data abroad, the Company will ensure that the destination country, international organization, or foreign data recipient has adequate personal data protection standards, or will ensure that the transfer of your personal data abroad complies with the requirements of the Personal Data Protection Act. In some cases, the Company may request your consent for transferring or sending your personal data abroad.

5. Retention Period of Personal Data

• 5.1 The Company will retain personal data only as long as necessary for the purposes of processing as specified in this Notice, as follows:
  
  • • 5.1.1 In cases where the Company processes your personal data based on your consent, the Company will process such personal data until you withdraw your consent.
  • • 5.1.2 In cases where you provide information to the Company as a contractual party, the Company will retain your data for as long as necessary to provide services to you during the contractual period and will retain it for an additional five (5) years after the year in which the relationship or contract ends.
  • • 5.1.3 In cases where you provide information to the Company as an event registrant, training/seminar participant, the Company will retain your data for as long as necessary to provide services to you and will retain it for an additional five (5) years after the year in which the relationship ends.
  • • 5.1.4 In cases where you register to receive news, we will process such personal data until you unsubscribe from receiving news.
  • • 5.1.5 In cases where you exercise rights as specified in this Notice, the Company will retain records of exercising rights under the Personal Data Protection Law for five (5) years after the month the Company completes consideration of your request.
  • • 5.1.6 In other cases, such as recording your history of exercising rights and enabling the Company to verify or take other actions to respond to your requests in the future, the Company will retain your personal data for as long as reasonably necessary to fulfill its obligations and achieve the purposes set out in this Notice. Where the retention period cannot be clearly determined, the Company will retain the data for a period that can be reasonably expected in accordance with standard retention practices (e.g., the maximum general statutory limitation period of 10 years). In the event of legal proceedings, your personal data may be retained until such proceedings are concluded, including any necessary period for actions required to achieve the purposes. After that, your data will be deleted or retained only as permitted by law.
  • • 5.1.7 Once the specified retention period has expired, the Company will delete, destroy, anonymize, or otherwise handle such personal data in accordance with the Personal Data Protection Law to ensure effective protection of personal data. However, the Company may retain certain data for longer than the periods specified above if necessary to comply with the law, or to comply with orders of lawful officials or competent government authorities, and for business purposes or as otherwise permitted by law.

6. Rights of the Data Subject

The Company respects your privacy rights and allows you to choose the methods of control or the means by which the Company contacts you. The Company will comply with your requests in order to promote transparency and ensure the quality and accuracy of your data. You have the rights under the Personal Data Protection Law, and you may submit a written request to the Company through the channels specified by the Company to exercise the following rights:

• 6.1 Right to Withdraw Consent: If you have given consent for the processing of your personal data (whether the consent was given before or after the Personal Data Protection Law came into effect), you have the right to withdraw your consent at any time while your personal data is with the Company. Withdrawal of consent shall not affect the lawful processing of personal data for which you have already given consent, except where such right is restricted by law, is inherently impossible to withdraw, or where there is a contract between you and the Company that provides benefits to you, or where withdrawal may result in the Company being unable to achieve part or all of the purposes specified in this document.

Please note that withdrawing your consent may have an impact on your use of services, such as no longer receiving benefits, promotions, or new offers, not receiving services tailored to your needs, or not receiving useful information. For your benefit, you should carefully study and inquire about the potential impacts before exercising your right to withdraw consent.

• 6.2 Right of Access to Personal Data: You have the right to request access to your personal data under the responsibility of the Company and to request the Company to make a copy of such data for you, including to request that the Company disclose how it obtained your personal data. This excludes cases where the Company has the right to refuse your request as permitted by law, court orders, or where your request may result in adverse effects that could cause harm to the rights and freedoms of other persons.

• 6.3 Right to Data Portability: You have the right to request the transfer of your personal data where the Company has prepared such data in a format that is readable or usable by automated tools or devices, and can be used or disclosed automatically. You also have the right to request the Company to send or transfer such personal data in that format to another data controller where it is technically possible to do so automatically, as well as the right to receive the personal data that the Company has sent or transferred in that format directly to another data controller, unless such transfer cannot be carried out due to technical reasons.

• 6.4 Right to Object: You have the right to object to the processing of your personal data at any time if the processing of your personal data is carried out for the purpose of the Company’s legitimate interests or those of another person or legal entity, provided that it does not exceed the scope that you can reasonably expect, or if it is carried out for tasks in the public interest, for marketing purposes, or for purposes related to scientific research or statistics.

If you raise an objection, the Company will continue to process your personal data only where the Company can demonstrate legal grounds that are more compelling than your fundamental rights, or where it is for the establishment of legal claims, compliance with the law, or defense in legal proceedings, as the case may be.

• 6.5 Right to Request Erasure or Destruction of Data: You have the right to request the erasure or destruction of your personal data, or to have your personal data anonymized so that it can no longer identify you, if you believe that your personal data has been processed unlawfully, or if you consider that the Company no longer needs to retain it for the purposes specified in this Notice, or when the Company agrees to comply with your exercise of the right to withdraw consent or the right to object as mentioned above.

• 6.6 Right to Request Restriction of Use: You have the right to request the temporary suspension of the use of your personal data in cases where the Company is in the process of verifying your request to rectify your personal data or your objection, or in other cases where the Company is required by law to erase or destroy your personal data but you instead request the Company to suspend its use.

• 6.7 Right to Rectification: If you find that your personal data is inaccurate, you may notify the Company to rectify or amend your personal data to be correct, or to update the data to be current, complete, and not misleading.

In the case where you wish to request rectification of data related to images, the Company will only rectify information related to your images as legally necessary for the Company. If fulfilling such a request incurs costs, the Company may charge such expenses. In cases where the Company has grounds to refuse your request, the Company will record such refusal along with reasons as evidence.

• 6.8 Right to Lodge a Complaint: You have the right to lodge a complaint with the Company through its website by selecting the “Data Processing Complaint Form” provided on the Company’s website if you believe that the processing of your personal data has been carried out in violation of, or in non-compliance with, the applicable laws.

7. Methods for Exercising Data Subject Rights

• 7.1 Any request to exercise your rights must be made in writing through the electronic system provided by the Company on its website, or by completing the Data Subject Rights Request Form, or, in the case where you wish to withdraw consent, by completing the Consent Withdrawal Request Form.

• 7.2 The Company will make every effort within the capability of its relevant systems to facilitate and act upon your requests, except where it is evident that fulfilling such requests poses a risk of violating the rights and freedoms of other users, conflicts with the law or the Company’s system security policies, or where compliance with the request is practically impossible due to technical reasons.

• 7.3 In certain situations, the Company may require you to verify your identity before exercising your rights for your own security. At times, there may be limitations in exercising some of your rights, in which case the Company will explain to you if it cannot comply with your request.

• 7.4 In cases where the Company processes your personal data based on contractual performance, legitimate interests, or legal obligations, the Company reserves the right to refuse your request if you object to or request suspension of use or disclosure, or request erasure or destruction of your personal data, if the Company deems it necessary to continue retaining the data for the following purposes.

• 7.5 If you are an event participant and do not wish to be photographed, you have the right to request and wear a “No Photography” symbol throughout the event. However, please be informed that due to the nature of the event, photographs of the event atmosphere may be taken, and even with such a symbol, you may still appear as part of the background in such images. Therefore, the Company recommends that you notify the Company to refuse while photos are being taken, avoid areas where photography is in progress, or choose not to participate during times when photographs or recordings are being made.

• 7.6 The Company must inform you that exercising certain rights may be subject to limitations in cases where such personal data is strictly necessary for the Company to fulfill its legal obligations, safeguard the Company’s security and surrounding areas, protect Company property, ensure safety within the event area, and ensure the safety of yourself, visitors, and other participants.

8. Security Measures

The Company has implemented appropriate measures to ensure the security of personal data in order to prevent loss, access, use, alteration, modification, or disclosure of personal data without authorization or in violation of the law. These measures are in line with the Company’s information security policies and practices, as well as its Privacy Policy.

9. Company Contact Channels

BSL Clinic Co., Ltd. is the coordinator responsible for the Company’s personal data protection matters. If you consider that the processing of personal data is not in accordance with the Personal Data Protection Act B.E. 2562, or if you have suggestions, questions, or wish to inquire about details regarding the collection, use, and/or disclosure of personal data, including exercising your rights under this Notice, you may contact or lodge a complaint through the following channels:

• Email: [email protected] and please complete the form (Link)

• Address: 30/8 Saladaeng Road, Silom Subdistrict, Bangrak District, Bangkok 10500

• Telephone: 099-343-8666

• Business hours: Daily, 10:00 a.m. – 8:00 p.m.

10. Amendments

The Company reserves the right to amend, review, and update this Privacy Notice, which shall take effect on the date of publication, without prior notice to you. This is to ensure appropriateness and efficiency in service provision. Therefore, the Company recommends that you read this Privacy Notice each time you visit or use the Company’s services or website.

Announced on May 31, 2022