(1) Personal information that can directly or indirectly identify the data subject, such as first and last name, gender, date of birth, age, nationality, contact details, information on cards or documents (e.g., ID card, house registration, passport, certificate of residence, alien registration card, work permit, social security card, driver's license, vehicle registration book), signature, taxpayer identification number, family member information, educational background, occupation, marital status, and photographs. In some cases, the Company may process sensitive data which requires your prior consent for collection, including race, religion, criminal record, facial recognition data, fingerprint data, iris recognition data, health information, work history, and/or other data as announced by the Personal Data Protection Committee.

(2) Contact information such as registered address, telephone number, Email, LINE ID, Facebook account.

(3) Financial or transactional data such as bank account numbers, credit card numbers, debit card numbers, ATM card numbers, income information, data generated from analyzing personal data, payment or receipt information, and any other data related to the use or request of services and/or transaction data through the Company's products or services.

(4) Communication data with the Company such as information received through branches, telephone, electronic or digital channels, social media, CCTV footage, and off-site services. Such data may be in written form, voice recordings, transaction logs, photographs, or videos.

(5) Usage data including usernames, passwords, search queries, view statistics, accessed menus, duration of use on websites/platforms/applications, favorites, Q&A data, feedback, and communication data with the Company.

(6) Information Technology (IT) technical data including computer IP address, Media Access Control (MAC) address, network-connected device identification numbers, logs, device IDs, API connection data, cookies, browser plug-in types and versions, operating systems and platforms, internet or mobile networks, device settings, and other technical data from using the Company's platforms, applications, and operating systems.

(7) Behavioral data including information about personal interests or preferences, and characteristics of using services.

(8) Employment-related data including start date, affiliated department, years of service, position, job history, employment certifications and references, employee ID, salary, wages and benefits, salary adjustment history, performance records and disciplinary data, termination date and type, time attendance records, leave history, bank account numbers, emergency contact details, life insurance beneficiary details (if any), educational background and grades, learning and development data, photographs, work history, non-monetary benefits, insurance-related data, family member information, meeting minutes, and opinions.

(9) Medical record data including illness records and medical reports.

(10) Scoring records and various test measurement results.

(1) For the necessity of considering and approving service requests or entering into a contract between you or the juristic person you represent and the Company.

(2) Legal obligations which the Company must comply with as required by law.

(3) For the legitimate interests of the Company or other persons or juristic persons.

(4) Necessity for public interest, public tasks, or the exercise of state power.

(5) For the use of products, privileges, or various services of the Company, including joint products, privileges, or services of affiliates and business partners.

(6) Contractual compliance, compliance with the Company's internal processes, sending/receiving data or documents between you and the Company, including compliance with government agency regulations necessary for fulfilling the contract between you and the Company.

(7) For the benefit of evaluating and improving services, product development, and/or sales promotions of the Company.

(8) To comply with legal obligations and law enforcement requests, including reporting or disclosing data to government agencies according to the law.

(9) For legal compliance auditing, establishing legal claims, complying with or exercising legal claims, or defending against legal claims.

(10) To conduct business planning, reporting, and forecasting, to prevent fraud, conduct investigations, or any other legal proceedings.

(11) For the administration or management of various risks that may arise from illegal acts affecting you, customers, personnel, and the Company, to be used in considering improvements to security systems across channels, operational systems, and IT security.

(12) For security in buildings, premises, including on the Company's buses, such as exchanging ID cards before entry, recording images and audio of persons, employees, and/or visitors via CCTV, cameras, and audio recorders for evidence and surveillance to protect life, health, and property.

(13) For maintaining customer relationships, such as coordinating inquiries, managing feedback, handling services and complaints (e.g., verifying transactions, sending/receiving data within the Company or with third parties), taking actions to support your complaints, providing compensation, or using it as data to adjust related work processes.

(14) To provide news or offer privileges regarding products or services of the Company, affiliates, or business partners that may meet your needs, or to organize promotional activities, sweepstakes, lucky draws, and to send various notifications to you.

(15) To survey desires, satisfaction, and opinions regarding products and services, and analyze member card usage, spending history, service usage, and your interests to offer suitable products or services and develop them to match your needs.

(16) To disclose to agents, contractors/subcontractors, and service providers for any of the Company's operations.

(17) For the legitimate interests of the Company, where such interests are no less important than your fundamental rights in personal data, such as securing Company property, conducting background checks from other sources, checking criminal records, and collecting biometric data for clock-in/out registration, etc.

5.1 Affiliates, companies involved in business operations, and/or any persons involved in sales promotions, internal management, offering products, and other services that may interest you.

5.2 Counterparties, partners, or other related organizations interacting in business with the Company, such as educational institutions, training institutes, private organizations, partners, customers, suppliers of the Company, etc.

5.3 Persons involved in providing the Company's services, such as transport service providers, Call Center operators, and intermediaries in various transactions of the Company.

5.4 Government officials or agencies with lawful authority or orders to proceed as required by law, such as legal reporting, disclosing data by court order or the Legal Execution Department, requesting disclosure by legal authority, and disclosing to government agencies overseeing labor, Social Security, taxation, the Royal Thai Police, financial institutions, etc.

5.5 Various advisors of the Company, such as lawyers, legal, financial, technical experts, and auditors.

5.6 Insurance companies where the Company is a party for group insurance, property insurance, compulsory, and voluntary insurance for service users or employees of the Company.

5.7 Persons or organizations hired by the Company to process personal data for managing the Company's missions, such as IT service providers, statistical data analysts, research and development teams, product or service designers, accounting firms, and payroll companies.

5.8 Other persons related to you, such as beneficiaries, authorized representatives, guarantors.

5.9 Websites, applications, and various social media such as Email, LINE ID, Facebook account, Messenger, etc.

(1) Right to request access to and obtain a copy of personal data.

(2) Right to request to receive, send, or transfer personal data to another data controller.

(3) Right to object to the collection, use, or disclosure of personal data.

(4) Right to request the deletion or destruction of personal data.

(5) Right to request the restriction of the use of personal data.

(6) Right to request the rectification of personal data to be accurate.

(7) Right to withdraw consent.

(8) Right to lodge a complaint.

Data Protection Officer or Data Protection Office

425 Sukhonthasawat Road, Lat Phrao Subdistrict, Lat Phrao District, Bangkok 10230

 Tel: 1215 or 02-0304999  E-mail: mkt@sombattour.com