Last Updated: September 2023

Your privacy matters to us as much as it does to you. We take great care in handling your personal data safely and responsibly.

1. Parties

• ACU PAY (Thailand) Co., Ltd. (hereinafter referred to as ‘the Company’) is a company incorporated in the Kingdom of Thailand under the laws of the Kingdom of Thailand, and operates the Website https://acuthai.com/ (hereinafter referred to as ‘this Website’ or ‘the Website’), which is a platform dedicated to e-money payment, e-commerce, currency exchange and the provision of related services (hereinafter referred to as ‘the Service’). For the convenience of wording in this Agreement, the Company and the Website are referred to collectively as ‘we’ or other applicable forms of first person pronouns in this Agreement.
• All natural persons or other subjects who log onto this Website shall be users of this Website. For the convenience of wording in this Agreement, the users are referred to as ‘you’ or any other applicable forms of the second-person pronouns.
• For the convenience of wording in this Agreement, you and we are collectively referred to as “both parties”, and individually as “one party”.
• These privacy terms apply to the Company products including ACU PAY and ACU PAY M.

2. Purposes of the Privacy Policy

The Privacy Policy stipulates the types of information of yours that we may collect through your log into this Website, your registration with this Website, and/or use the services we offer, as well as how we shall use and protect the information so collected.

3 Your consent

• To ensure that you have full confidence in our handling of personal data, you are advised to read and understand the terms of this Privacy Policy in detail. In particular, upon your log into our Website, regardless of whether you register with this Website, you shall be deemed to accept, agree, undertake and confirm that:
• 3.1 You, on the basis of your own free will and your requisite consent, agree to disclose your personal information to us;
• 3.2 You will comply with all the terms and limitations of this Privacy Policy;
• 3.3 You agree that we may collect your information when you visit or otherwise use the Services offered by us; you agree to any changes and modifications that we may make to our Privacy Policy in the future;
• 3.4 You agree that our branches, affiliates and employees may contact you in connection with the products and services that you may be interested in (unless you have indicated that you do not want to receive such information).

4. What kind of data is being collected?

We may collect and process “Personal Data” (which is defined as any data that identifies or can be used to identify you) about you when you visit, install, download, access, register for or use our Services, or contact us in relation to the Services. The nature of the Personal Data that we may collect, and process will be determined by how you are using our Services. We will only use your Personal Data as set out below and always in accordance with applicable data protection laws.

We do not collect special categories of Personal Data, which means Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade union membership, genetic and biometric data, or data concerning health, sex life or sexual orientation. We do not expect our users to share or provide us special categories of Personal Data.

Information that you provide to us and personal data we may collect:

• basic Personal Data about you (such as first name; family name; mobile number; email address, country and your language);
• images. User can optionally upload an image as account avatar. During the eKYC process, user needs to upload ID photos for identity verification purpose.
• for eKYC (know your customer) process, we ask you to upload both the front and back sides of your ID card. Your ID card information will be sent to third party company for verification.
• If you link your credit card or debit card, your card information (such as card type and expiration date) and other financial data that we need to process your requests may be collected and sent to third party payment processors with which we work.
• when you use Services to do thing like send a message in Zendesk or do transactions, we store the information you create.

Information that we automatically collect or generate about you:

When you use our Services, we automatically receive and collect information about you and your device.

• any information regarding the Services accessed and/or used by you and our interactions with you;
• usage data when you use the Services, including application version and IP address;
• activity data relating to your usage of the Services, which reveal your preferences, interests, or manner of use of the Services and the times of use, e.g., IP address, device type, device brand, other unique device identification, language settings etc.

5. What is this data being used for?

Your Personal Data may be stored and processed by us in the following ways and for the following purposes:

• • in order to comply with and in order to assess compliance with applicable laws, rules and regulations, subpoenas, legal processes, governmental requests, and internal policies and procedures;
  • to allow you to use and access the features and functionality provided by the Services;
  • to set you up to use the Services, including creating and administering your account;
  • for optimising the Services and your experience using the Services, and for ongoing review and improvement of the information provided on the Services to ensure that it is user friendly;
  • to take measures to protect against and try to prevent any potential disruptions or cyber-attacks;
  • to understand your needs and interests and, where you have provided your consent, to send you marketing communications about our Services;
  • to provide you with technical and other support;
  • for the management and administration of our business or in relation to a sale, reorganization, financing or other similar corporate transaction involving our business;
  • for the administration and maintenance of our databases storing Personal Data; or
  • to detect, prevent, or otherwise address fraud, security or technical issues.

However we use your Personal Data, we make sure that our usage complies with applicable data protection laws. The law allows or requires us to use your Personal Data for a variety of reasons. These include where:

• we need to do so in order to perform our contractual obligations with our customers and third-party providers;
• we have obtained your consent;
• we have legal and regulatory obligations that we have to discharge;
• we may need to do so in order to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
• the use of your Personal Data as described is necessary for our legitimate business interests, such as:
  • allowing us to effectively and efficiently manage and administer the operation of our business and the Services;
  • to enforce contracts and applicable Terms of Use, including investigation of potential violations thereof;
  • maintaining compliance with internal policies and procedures;

6. Who is my data disclosed to?

• We may disclose your Personal Data to other companies within our group for the purposes set out in “What is this data being used for?” above, as well as to law enforcement and regulatory agencies as may be required by law.
• If you use certain features in the Services, for example linking your credit card or debit card, which will include any personal data contained in such content, will be shared to the payment processor. During identification verification, your ID card information will be shared to an eKYC provider that we work with.
• We may disclose and transfer your Personal Data to our agents, contractors or vendors (“Service Providers”). When we do this, we will ensure that they are under a duty of confidentiality to us and we have imposed contractual obligations to ensure they can only use your Personal Data to provide agreed services to us and to you. Such Service Providers may provide administrative, data processing or other similar services to us to enable us to better provide the Services.
• In particular, certain of the specific third parties that we disclose data to include:
  • We use Zendesk by Zendesk Inc for handling customer support. In this case, messages you sent via Zendesk are stored in their system.
  • We use third party service to collect and diagnostic and usage data and monitor the infrastructure for ACU Cloud.
  • We may use JPush or other third party providers to notify your of important events about the Services and provide you with an enhanced user experience when using the Services. In this case, your device token for pushing notification is stored in JPush system.

7. Retention Process

How long we will hold your Personal Data for will vary and will be determined by the following criteria:

• the purpose for which we are using it – we will need to keep your Personal Data for as long as is necessary for that purpose; and
• legal obligations – laws or regulation may set a minimum period that we have to keep your Personal Data.

8. Data Deletion

The main principle of deleting user data is to disassociate the data retained by the system from the user’s true identity. System will either permanently delete user data or perform data masking.

• ACU PAY and ACU PAY M user can request to delete their personal data by contact us at info@acuthai.com.
• ACU PAY user can also delete user data by using the account deletion function in the ACU PAY mobile application.
• Once user’s account is deleted, basic personal data ( mobile number, name, address, email, ID number. ID card photo, avatar photo) will be either permanently deleted or masked.

9. Cookies

• When you visit our Website, we use Google stats via cookies to record our performance and check the effect of online advertising. Cookies are a small amount of data that is sent to your browser and stored on your computer hard drive. Only when you use your computer to access our Website can the cookies be sent to your computer hard drive.
• Cookies are usually used to record the habits and preferences of visitors in browsing the items on our Website. The information collected by cookies is non-registered and collective statistical data and does not involve personal data.
• Cookies, which enable the Website or service provider system to recognize your browser and capture and recall information, cannot be used to obtain data on your hard drive, your email address, or your personal data. Most browsers are designed to accept cookies. You can opt to set your browser to reject cookies, or to notify you as soon as possible if you are loaded on cookies. However, if you set your browser to disable cookies, it is possible that you may not be able to launch or use some functions of our Website.