Privacy Notice

2. Purposes for Which Your Personal Data are Collected, Used or Disclosed.

     THAI will proceed to collect, use, or disclose your personal data according to the conditions described by laws; namely (1) contractual basis, for THAI’s initial or fulfillment of a contract or request made by you to THAI (2) legal obligation imposed on THAI as required by the law (3) legitimate interest of THAI or other persons or juristic persons (4) vital interest of persons (5) necessary for a public interest, public task or the exercise of the right by the public sector or (6) your consent in case the collection, use, or disclosure that are outside the scope as described in (1) to (5) above, for any of the following purposes;

2.1 to contact, communicate or provide information about the products or services that you use or will use;

2.2 to fulfill your request or contract that you have with THAI or associated with the request or contract that you made with THAI, for example, delivery of document, demand for debt payment, subscription and allocation of shares, verification of type and amount of debt obligations under THAI rehabilitation plan for debt conversion into capital, verification of the number of common shares that you are obligated, entitled, or may exercise from debt conversion into capital under THAI rehabilitation plan including to comply with the contracts that we have with third parties which are necessary and related to the provision of a service to you;

2.3 to manage relations between you and THAI, and to prepare detailed or historical records of services provided to you for provision of services to you in the future;

2.4 to manage information of corporate customers in which your personal data may be involved;

2.5 to comply with laws, rules, and regulations;

2.6 to perform any acts as the supervisory authorities may describe, request or recommend to comply;

2.7 to manage and administrate THAI’s internal businesses, e.g. compliance, improvement, or internal audit including compliance with THAI regulations or requirements;

2.8 to manage or administrate all risks e.g.
     (1) to prevent, handle, or minimize risks arising from illegal acts that may occur to you, the customers, THAI’s personnel, and THAI by using the data for improvement of the security system through various service channels, working systems, and safety and security systems for information technology operation of THAI;
     (2) for security purposes, e.g. photo recording of the person contacting or involving in a transaction with THAI via CCTV and the exchange of identification card when accessing the building for security reasons within THAI areas;
     (3) to disclose and transfer your personal data to third parties as part of a business transaction such as sale, transfer, merger & acquisition, organizational restructuring, implementation of THAI Rehabilitation Plan or similar transactions;

2.9 to procure and offer products, services, and alternatives of services to you, including communication, notice and warning, delivery or offer of privilege, benefits, awards or information about products or services of THAI, the companies in THAI group or business alliances which may be of interest to you, or for sale promotion or lucky draw activity;

2.10 to authenticate and verify the identity, and examine the use of services or transactions according to your orders;

2.11 to manage all complaints e.g. the investigation on the use of the services or transmission of data within or between THAI and third parties, the process of accepting your complaints, compensation or use of information for improving such services;

2.12 for statistical analysis or research in connection with business operation of THAI and its subsidiaries;

2.13 for strategic purposes, protecting interest or evaluation of the business result or services of THAI;

2.14 for evaluation, development, and improvement of products or services or for execution of the rights by THAI;

2.15 for marketing promotion project or activity, meeting, seminar, entertainment or site visit;

2.16 for storage of data on cloud service (Cloud Storage) and other systems used for storing data;

2.17 for the performance of the contract to which THAI is the contracting party or for enforcement of the rights under the law or contracts binding THAI;

2.18 for connecting or facilitating the use of the website, application, and platform of THAI or other persons;

2.19 for application for a job or employment, recording of working hours, payment of remuneration and other benefits, performance evaluation, audit, and record of the use of information technology services, operation management, disciplinary action, learning, and self-development;

2.20 for occupational health and safety purposes, severance pay, and insurance claims;

2.21 for the submission of the meeting agenda, and schedule of the meeting, registration, meeting attendance, counting of votes, meeting management, meeting minutes, questions and comments, dissemination of meeting minutes in written, visual, audio and/or video formats;

2.22 for use of data and photographs for THAI internal and external communications

2.23 for specific purposes related to criminal records in collecting personal data relating to criminal records, such as:
     (1) for the purpose of verifying and assessing qualifications, checking prohibited characteristics, and characteristics indicating fitness to be entrusted with the management of THAI’s affairs, and considering the suitability for holding a position, including granting permission, endorsement, certification, approval, and providing opinions in the consideration of election or appointment, to enable THAI to select appropriate individuals to hold positions of THAI and perform their duties efficiently in compliance with laws and orders of authorized officials;
     (2) for the purpose of allowing THAI to collect, retain, use, and/or disclose criminal record for more than six months from the date the related activities are completed, for the purposes and to the extent necessary for the collection, use, and/or disclosure of personal data, for the necessary management of THAI.

     The collection, use, or disclosure of your personal data including the cross-border transfer thereof shall be performed in accordance with the above principles.

3. Persons or organizations who the data may be disclosed to

     THAI may be required to disclose your personal data to other persons or organizations within or outside the country in order to fulfill the purposes under this notice as follows:

3.1 Subsidiary Companies consisting of Thai Smile Airways Co., Ltd., Thai Flight Training Co., Ltd., Thai-Amadeus Southeast Asia Co., Ltd., Tour Euang Luang Co., Ltd., and WingSpan Services Co., Ltd.

3.2 Business Alliances for example, business alliance in air transport, tourism, hotel, car rent, marketing, financial institution, insurance or life assurance or any persons involving the promotion or loyalty program, data analysis, joint platform service provider, or person whose name or trademark appears on the contract, website, or other service channels of THAI.

3.3 Persons Involving in the Services of THAI for example, other airlines, business partners, ground handling agents providing check-in and baggage services, cargo accepting and delivery services, call centers, person who performs as intermediary in transactions for THAI, joint provider with THAI, outsourcing service provider, contractor or seller of goods or service to THAI or domestic and international agent of THAI for when THAI is a contracting party, for example, infrastructure development provider, technical infrastructure developer, electronic or information technology system developer, logistics and cargo terminal service provider, cloud computing service provider, data analysis provider and event and activity organizers.

3.4 Person or Organization as Described by Laws THAI may be required to disclose your personal data in order to comply with laws, rules, regulations or orders of the government agency, state agency, supervisory agency or in case THAI believes that the disclosure is necessary for complying with laws to protect the right of THAI or other persons, for the safety of a person, to protect, investigate, or manage fraud, security or safety in various areas, for example, tax authority, fund administrator, social security authority, or financial institution. THAI may be required to disclose the personal data to the Royal Thai Police, the Office of the Securities and Exchange Commission, or other relevant agencies involved in the collection of personal data relating to criminal records, for verifying qualifications and for checking characteristics indicating fitness to be entrusted with the management of THAI’s affairs as required by law.

3.5 Advisors of THAI, for example, legal, financial, technical experts and auditors.

3.6 Right and Obligation Assignee or Novation Assignee, including the person involved in company restructuring, business assignment, investment, merger and acquisition, purchase or sale of properties, shares or businesses by a person involving in such activities, shall be in accordance with this notice.

3.7 Other Related Persons, for example, beneficiary, person authorized to act on behalf of another, or guarantor.

3.8 Association, Organization, Club and Other Bodies, for example, Thai Airways Employee Saving Cooperation, Thai Airways Employee Club.

3.9 Websites and Other Social Media, for example, THAI Websites, Facebook, Google, or Instagram

     THAI shall inform the person or organization whom the data has been disclosed to comply with THAI’s policy and laws for the security of your data. THAI shall allow the use of your personal data for the intended purposes and according to instruction of THAI only.


4. Storage of Your Personal Data and Duration.

4.1 Storage of Your Personal Data

     THAI has established security measures to protect your personal data both in document and electronic form to prevent loss, unauthorized access, use, alteration, modification, or disclosure of personal data without rights or unlawfully.

4.2 Duration for Storage Your Personal Data

     THAI will collect your personal data for the purposes specified in this notice, as required by laws, and for a maximum of 10 years from the date you end your relationship with THAI, except when it is otherwise necessary by laws or such personal data are unable to be erased or destroyed due to the technical limitation.

     For the personal data relating to criminal records, THAI may collect, retain, use, and/or disclose criminal record for more than six months from the date the related activities are completed, for the purposes and to the extent necessary for the collection, use, and/or disclosure of personal data.

5. International Transfer of Your Personal Data.

     In case THAI is required to transfer your personal data to other persons or juristic persons in other countries, for example, your contracting party or THAI’s contracting party, THAI’s representatives, THAI’s overseas branches, the subsidiary companies, international agencies or organizations, and data protection measures in the destination country may not be equivalent to those required by laws. THAI will take appropriate measures to ensure that your personal data is transferred safely

     Personal data may be shared to individuals involved in providing services on behalf of THAI for the purposes identified above. In this case, we use additional safeguards to protect your personal data such as the “Data Processing and Transfer Agreement” and “Standard Contractual Clauses” for transferring personal data to the business operator outside the EU/EEA or Thailand (as the case may be). We process your data mainly within the Kingdom of Thailand and the EU. If you use services that involve data transfer to other countries which may have data protection measures equivalent to or different from those in the Kingdom of Thailand or the EU, such as international flight connections, we will transfer your data to those countries. In this respect, please refer to the general privacy policy of the International Air Transport Association (IATA) https://www.iatatravelcentre.com/privacy.htm

     When you are an individual in the EU and processing your personal data falls under GDPR, in some cases when we transfer your data to destinations countries outside the EU or EEA, we will use additional safeguards to protect your personal data according to the “Standard Contractual Clauses” as stipulated by Applicable Privacy Laws and endorsed by the European Commission. A copy of the clauses can be provided for your review upon request to the contact details provided in section 10.


6. Website System used for collecting the Data.

     When accessing the website system of THAI, THAI will automatically collect certain data from your usage for the purposes detailed in this notice, for example, THAI will use the data recorded or collected by cookies and similar technologies for statistical analysis or other activities related to the website system or business of THAI. This helps THAI provide you with a better website experience, including the improvement of efficiency and quality of THAI’s website services.


7. What rights do you have?

     As the data subject, you may exercise the following rights;

7.1 Right of Access and Request a Copy
     You have a right to access and obtain a copy of your personal data which is under our responsibility, or to request THAI to disclose the acquisition of such personal data that you did not consent to.

7.2 Right of Data Portability
     You have a right to obtain personal data we hold about you, where we rely on consent basis or necessary for the performance of the contract basis, by a request you have made to THAI, or as announced by the Personal Data Protection Committee. If THAI has made such personal data available in a readable format that can be used generally by automated tools or devices and can be used or disclosed by automated means, you also have the right to: (1) request THAI to send or transfer such personal data to another data controller when it can be done by automated means; and (2) receive the personal data that THAI has sent or transferred in such format directly to another data controller, unless it is technically unfeasible.

7.3 Right to Object
     You have a right to raise an objection to the collection, use or disclosure of your personal data by THAI in the following cases: (1) THAI collects your personal data due to the necessity of performing a task for THAI’s public interest, the exercise of right by the government sector, or for the legitimate interest of THAI, other persons or juristic persons; (2) THAI collects, uses, or discloses your personal data for the purpose of direct marketing; or (3) THAI collects, uses, or discloses your personal data for the purposes of scientific, historical or statistical research, unless it is necessary for THAI to perform a task for the public interest.

7.4 Right to Erasure or Destroy Personal Data
     You have a right to request THAI to erase, destroy, or anonymize your personal data in the following cases: (1) your personal data is no longer necessary for the purposes for which it was collected; (2) you withdraw your consent and THAI has no other legal grounds to continue collecting, using, or disclosing such personal data; (3) you object to the collection, use, or disclose of your personal data collected by THAI due to the necessity of performing a task for the public interest of THAI, the exercise of the right by the public authority, or for the legitimate interest of THAI, other persons or juristic persons, and THAI has no overriding legitimate grounds to refuse such objection; (4) you object to the collection, use, or disclosure of personal data for direct marketing purposes; or (5) your personal data are unlawfully collected, used or disclosed, except when it is necessary for THAI to collect your personal data for compliance with legal obligations or for the establishment, exercise, or defense of legal claims or the use or protection of the right of THAI.