Customer Privacy Notice (ENG)

Customer Privacy Notice

Group of Grand Sport Companies, which includes but is not limited to (i) Grand Sport Group Company Limited; (ii) Grand Marketing Company Limited; and other affiliated companies (collectively referred to as the “Company”) as a producer and distributor of apparel products and sports equipment (the “Products”) via various sales channels under Group of Grand Sport Companies gives highest priority to the Customer’s privacy and respects Customer’s Personal Data.

The Company as a controller intends to announce this Customer Privacy Notice (the “Notice”) that defines the rights, conditions, and necessity of the Company in collecting, processing, and using the Personal Data of you, the Company’s customer, who may communicate with the Company; and/or purchase the Products (the “Customer”) to the Customer for information.

The Notice Acceptance

This Notice shall apply to any contact and/or Products purchase that the Customer (i) contacts directly to the Company, via offline contact channels, including actual storefront purchasing or any other direct purchase or via Company’s online contact channels, including website or social media (Facebook / LINE Official Account or other online platforms); and (ii) contacts other third parties distribution channels which are managed and organised by the Company.

This Notice shall not apply to the third party’s Personal Data processing which the Company does not have the authority to control with respect of such Personal Data processing executed by those third parties, even if it connects to the Company’s service (which includes but is not limited to the Personal Data processing by online distribution system service provider or other marketplace channels). The Customer must study the privacy notice as announced by such third party which is excluded from this Notice.

Upon the Customer contacts and/or purchase the Products via various channels, including submitting the Customer’s Personal Data to the Company, the Company shall deem that the Customer already agrees and accept this Notice.

The Company reserves the right to adjust and amend this Notice from time to time to be consistent with the relevant laws and regulations and to reflect the contracting, selling, and delivery, including other services of the Company providing to the Customer. According to the adjustment and amendment of the Notice, the Company shall inform the Customer about such change by announcing the new Notice via the Company's channels.

Word Definitions

Under this Notice, (a) “Personal Data” means the information which can be directly or indirectly used to identify a natural person, but not including the information of the deceased persons; (b) “Data Subject” means the person who is the owner of the Personal Data collected, used or disclosed by the Company, which includes but is not limited to the Customer who is a natural person and the authorized representative person or other related persons of the Customer who is the legal entity (such as authorized director or a relevant attorney).

For the avoidance of doubt, in the case that Customer shared the Personal Data of any other Data Subject to the Company, when the Company has received such Personal Data, the Company shall assume that the Customer has guaranteed the right to transfer and disclose all such Personal Data to the Company for processing under this Notice.

The Source of the Personal Data Processing

The Company may receive the Personal Data of the Customer and/or the Data Subject from two sources as follows:

Receive Directly from the Customer via channels which include (a) the contact through various channels which the Company may have, such as telephone, social media and website, (b) the visit to the Company’s shop or the Company’s website, (c) the Customer’s participation in the Company’s promotional activities, (d) the provision of the Personal Data in any form relating to the purchase of Products and the use of any relevant services or (e) automatically collection of those Personal Data by the Company’s system which may collect and use the Personal Data while the Customer contacts the Company via online channels, in particular when the Customer visits the Company’s website.

Receive indirectly from the third party, which may include an external service provider engaged to provide relevant services related to the Product selling and services delivery of the Company (which may include but is not limited to the marketplace service provider); or other persons who may refer the Customer to us to contact which the Company shall inform the Customer of those sources.

Personal Data to be Processed

During the coordination, the Product purchase, price payment and Products delivery between the Company and the Customer, the Company need to process the Personal Data of the Customer in each step as follows:

For the Customer who purchases the Product at Grand Sport’s storefront, the following Personal Data will be collected: the facial image of the Customer, which the Company may collect by CCTV system installed in the store’s area and facial image taken from the Customer’s participation in the event hosted by the Company, including the live broadcast or the video or portrait taken in the store area.

in case the Customer does not want his/her photo taken in any event, the Customer should avoid entering such area or please feel free to let the Company’s staff know.

For the Customer who purchases the Product online, the following Personal Data will be collected: (1) the order information, including the details of the order, the Product purchased and the total amount of the purchase; and (2) the Customer’s online identifier, including the IP address, the domain name and other pages which direct the Customer to the Company, browser type and version, the configuration information or operating system information of the Customer's device; or (3) cookies (that will be collected with the Customer’s consent). Please feel free to study the Company's Cookies Policy additionally.

For the Customer who purchase Products directly offline, including via the coordination to purchase Products from the Company’s sales department, in particular in case that the Customer is legal entity, the Company would need to collect the information of the Customer’s authorized director which includes the copy of Identification card and contact information of such representative.

For any payment made by the Customer or any request for tax invoice, the following Personal Data will be collected: the Product’s payment information, for instance, payment Slip or credit card information collected via POS system and other proofs of payment. In case the Customer requests for a tax invoice, the information in the identification documents (such as an Identification card or passport) and copies thereof shall be collected.

For the Product delivery in case of online or offline purchase that the Customer would request for delivery services, the following Personal Data will be collected, including name and surname, delivery address, and contact information such as mobile number or email.

Other Personal Data, the Customer, may give to the Company in various documents to be made and delivered between the Company and the Customer, which includes but is not limited to, warranty card or maintenance request form in the case of some sports equipment sale as required in the Company’s conditions; or any information that the Customer may give to the Company for the participation in the promotional sale activities, competition survey, prize draws or any activities of the Company.

Any other Personal Data that the Customer may deliver to the Company for processing, for instance, any information collected during the call to request for supporting services or to file the complaints via the channels specified by the Company.

Objective of the Personal Data Processing and the Retention Period

The Company has the necessary to collect, use and process the Personal Data information of the Customer (as defined above) to serve the following purposes and for the following retention period:

For the performance of a contractual obligations, the Company shall process such the Personal Data for the following objectives:
To respond to any query or manage the complaint or the feedback received from the Customer;
To prepare the sale document, including but not limited to accounting or contract documentation (if relevant);
To coordinate with the Customer in the performance of the contractual rights and obligations that the Company may have under the relevant sale and purchase agreement (and other relevant service contracts) between the Company and the Customer, which include the process of the Personal Data for the purposes of order confirmation; buying Customer validation; payment receipt check; Products delivery and installation and Products maintenance as defined by the Company;
To perform any other contractual obligations that the Company and the Customer may have; to respond to the Customer’s request; and to confirm the eligibility of the Customer to participate in the event hosted by the Company.

For this objective, the Company would need to retain the Customer’s Personal Data throughout the period of time that the Company still has an obligation to deliver Products or other relevant services to the Customer under the relevant sale contract or other service contracts.

For the performance of the legal obligations that the Company may be subjected to, for instance, for accounting and tax payments obligations, in particular in case the Customer may request a tax invoice from the Company, the Company would need to collect the Customer’s Personal Data filled in those documentation for the period of time as prescribed under the relevant laws.

For the exercise of the legitimate interests without excessively cause impact on the Customer’s right as the Data Subject, the Company shall process such the Personal Data for the following objectives:
To build and improve the business relationship between the Company and the Customer, in particular, the Company may process the Personal Data to conduct analysis, investigation, complaint management that relates to the services provided by the Company; to conduct customer satisfaction survey; to prepare customer service internal audit report preparation; to assess and manage the enterprise risk; to conduct training and to monitor the employee’s service satisfaction. For this particular objective, the Company reserve the right to process those Personal Data for so long as it is necessary and may retain the statistic information continuously thereafter;
To use the Personal Data for the Product or services improvement and the Customer segmentation for the marketing and public relations planning;
To use the facial image of the Customer at the storefront, which the Company may collect by CCTV system for the store and the Customer security;
To use the images and the other Personal Data of the Customer who participates in the various promotional activities hosted by the Company for the production of the Company’s marketing materials; and
To collect the Personal Data for the benefit of protecting the lawful rights of the Company in the case of any complaint or defense legal proceedings to be initiated between the Company and the Customer.

For this objective, the Company shall process the Personal Data as necessary for the reasonable period of time for the Company’s business operation without causing excessive impact on the Data Subject’s rights.

In case Consent given by the Customer, the Company shall process the Personal Data of the Customer for the purpose that the Customer gives the consent for the Company to process, such as to contact to such Customer for marketing purposes of the Company’s Products and the affiliate (Including but not limited to the Products of Grand Sport and other band) that would match the Customer’s interest via various communication channels.

The Company shall process the Customer Personal Data for the purposes defined under the consent until the Customer withdraws the consent; provided that the withdrawal shall not affect the collection, use, disclose or process of the Personal Data undertaken with the Customer’s prior consent.

Disclosure of the Personal Data

In principle, the Company shall not disclose or transfer the Customer's Personal Data to any third party. Nevertheless, in case of necessity, the Company may need to disclose and transfer such Personal Data to the following third party:

To the relevant external service provider, which may include (i) the affiliates, partner company, the external service provider which provides support service to the Company in the performance of the Company’s rights and duties to the Customers, (ii) the service provider who involves in the business operation of the Company, including but not limited to, the consultants; provided that the Company shall only disclose the Customer’s Personal Data only as necessary under the defined scope of the Personal Data processing agreement entered into between the Company and such external service providers.

In case the Personal Data shared to the external service providers that operates and processes the Personal Data outside of Thailand, the Company shall define the information security standard to be implemented by such service provider that shall meet the information security measures that is acceptable and compliance with the relevant laws in the data processing agreement to be entered into with the service provider in order to ensure the security of those Personal Data.

To government authorities, which the Company is obliged under the relevant laws or the government judgment or orders to disclose the Personal Data to such relevant government agencies, including the Revenue Department; provided that the Company shall disclose the Personal Data only on the necessity basis to perform those specific duties.

To other persons that the Customer gives explicit consent to the Company to disclose such Personal Data to.

Security measures for the Personal Data

The Company represents to implement the appropriate information security under the framework defined under the relevant laws to prevent the Personal Data from unauthorized access, use, amendment or disclosure and the Company commit to review the information security measures from time to time to ensure the compliance with the best industry practice and relevant laws.

Data Subject’s rights

The Company respect the Customer’s statutory rights as the data subject over their related Personal Data in the Company’s control. The Customer can request to exercise their rights under the relevant laws as follows: (1) the right to withdraw given consent; (2) the right to request access or copy of their Personal Data; (3) the right to revise their Personal Data; (4) the right to request for data portability; (5) the right to object to any process of their Personal Data; (6) the right to request for deletion or de-identification of their Personal Data once there is no further necessity; (7) the right to request for the suspension of the processing of their Personal Data; and (8) right to make the complaint.

Please feel free to contact the Company if you have any queries regarding this Notice or if you would like to request to exercise any of those defined rights and the Company will inform the consideration of such request within the reasonable period of time as defined under the relevant law.

Please contact us at dpo@grandsport.com