WWW.KINTO-TH.COM
Toyota Leasing (Thailand) Company Limited

Latest update in March 2025

1. Principles and objectives

Toyota Leasing (Thailand) Company Limited (“the Company”) is committed to strengthen personal data protection in accordance with the Personal Data Protection Act B.E. 2562 and relevant laws and therefore introduces this Personal Data Protection Data Policy to ensure the Company’s compliance with laws and international standards on personal data protection. In addition, the Company has established rules for the protection of personal data of data subjects and has implemented effective and appropriate measures for addressing any violations of the rights of data subjects.

2. Scope of enforcement and application

The scope of enforcement and application of the Personal Data Protection Policy prepared in accordance with the Personal Data Protection Act B.E. 2562 and relevant laws covers all processing of personal data performed by the Company, as well as any person who comes into contact with personal data because it is related to the Company's operations and must therefore comply with this Personal Data Protection Policy and the legal framework, which is subject to the contractual clauses, rules, and terms of the Company’s services and products, e.g., websites, mobile applications, documents, or any other services under the control of the Company (“Services”). 

The categories of personal data, which are processed by the Company, will include the followings: 

1) Customers who are a natural person. 

2) Staffs, responsible officers, or employees. 

3) Trading partners or service providers who are a natural person 

4) Directors, authorized persons, representatives, agents, shareholders, employees of a company, or any other persons who are related to a juristic person having business relationship with the Company.  

5) Users of products or services of the Company. 

6) Visitors or users of websites, mobile applications, devices of the Company, or any other communication channels that are controlled by the Company. 

7) Persons whose personal data are collected by the Company such as job applicants, family members of the Company’s staffs, guarantors, beneficiaries of insurance policies. 

Item 1) to 7) will be referred to as “data subject” 

With respect to personal data collected prior to the introduction of the Personal Data Protection Act B.E. 2562, the Company is enabled to continue collecting and using the personal data for initial purposes. Any disclosures and acts other than the collection and use of personal data must be in compliance with the Personal Data Protection Act B.E. 2562 and other relevant laws.
 

3. Personal Data Collection

The Company’s collection of personal data (such as specific personal information, information related to personal life or personal interests, financial information, sensitive personal information, as necessary and permitted by law) is to be based on the following sources and principles:

1. 3.1 Sources of personal data 

The Company may receive personal data from the following channels: 

3.1.1 Collection from the data subjects, for example, collection of personal data from filling out personal information in application forms, either in paper form or online, responses to surveys conducted by the Company, recruitment process, the signing of contracts or documents, or the data subject’s communication with the Company via the specified channels.   

3.1.2 Collection from the data subjects who access or use websites, software, or applications under service agreements such as behavior tracking on websites, products, or services of the Company by using cookies technology or software on a data subject’s personal device. 

3.1.3 Collection from social media providers or third-party account providers where a data subject provides permission to share his/her personal data with the Company when linking his/her third-party account with the Company’s services. In this case, the personal data shared with the Company will be based on a data subject’s setting and third-party providers’ privacy policies.  

3.1.4 Collection from sources other than the data subjects, where the Company are eligible for collecting from such sources or is authorized by the data subject for the collection, for example, searches for personal data via a website, inquiries made by third parties, or the disclosure made by the affiliates, group companies, business partners or third parties of the Company for fulfilling the purposes as specified in this Privacy Policy.  

Examples of types or categories of personal data that the Company may collect are as follows:

Type	Description and Examples
Specific Personal Information	Title, name, identification number or passport number, nationality, information of household registration, information of driving license, signature, social security number, or any official documents identifying an identity of a person.
Information Relating to Personal Characteristics	Date of birth, gender, height, weight, marital status, status of military service, photograph, spoken language, information relating to a person who is declared bankrupt, quasi-incompetent or incompetent etc.
Contact Information	House phone number, mobile phone number, fax number, email, mailing address, social media account (an account of social media website/application, e.g., Line, Facebook, Apple, Google, or Microsoft) residential location etc.
Information Relating to Educational Backgrounds and Work Experience	รายละเอียดการจ้างงาน รวมถึงประวัติการทำงานและประวัติการศึกษา เช่น ประเภทEmployment background, including work experience, and educational background, e.g., types of employment, profession, rank, position, role and responsibility, proficiency, status of professional license, information of referee, emergency contact person, tax identification number, professional appointment, employment history, salary information, start date and end date of employment, performance appraisal, welfare and benefits, properties possessed by an employee, career achievement, bank account number, educational institutions, academic  degree, academic transcript, graduation date, information relating to workplace attendance and work attendance.
Information Relating to Insurance Policies	Details of an insurance policy, e.g., a name of an insurer, an insured person, and a beneficiary, insurance policy number, types of insurance policy, sum insured, claims history.
Information Relating to Social Relation	Details relating to the data subject’s social relationship, e.g., political status, political position, information relating to the conflict of interest with the Company.
Information Relating to Service Access	Details of a product or a service, e.g., user account, password, PIN code, OTP code, traffic data, location data, photograph, video recording, voice recording, behavioral data, search history, cookies or similar technologies, device ID, types of devices, connection information, browsing history, system language, operating system.
Financial Information and Transaction History	Financial information, information relating to financial performance, or financial records, e.g., savings account number, transaction records, credit history, income tax return form, pay slip, records of utility bill payment, information relating to the possession of assets or properties.
Information Relating to Vehicles	Information and details relating to vehicles and vehicle registration, e.g., license plate number, vehicle identification number (VIN), registration data, GPS data.
Sensitive Personal Information	Sensitive data, e.g., information on race, religion, disability, political opinion, criminal record, biometric data (such as facial recognition data, fingerprint data), health data.
Others	Data analysis relating to marketing statistics of data subjects, CCTV footage, conversations and communications by telephone or electronic equipment etc.

3.2 Principles of personal data collection

3.2.1 The Company will only collect personal data that is necessary for the operations of the Company. However, the purposes for which the Company processes personal data may differ by case, and can be exemplified as follows:

 

Purpose of Processing	Description
To take steps at the request of the data subject prior to entering into a contract and to perform the contractual obligations between the Company and the data subject.	Processing of personal data for the purposes of the access to the Company’s services or entering into an agreement with the Company, for example,  Entering into a lease or hire-purchase agreement of vehicle. Using a product or service provided under the KINTO trademark/service mark. Using e-commerce services such as Gurumalist, ShopSabuy, TripSabuy. Using insurance brokerage service of the Company
To identify and verify the identity of a person.	Verification process of the data subject’s identity prior to accessing services or entering into contracts with the specified methods by the Company or identification process of identity for making transactions as well as verifying the validity of data subject’s signature.
To provide answers to the customer's inquiries and to provide assistance to customers.	Providing assistance to customers in relation to service access, e.g., providing information regarding the process of personal information update, payment methods, credit history, or submitting a request for exercising of the data subject’s rights or a request for complaint.
To provide information regarding products, services, or marketing publicity	Offering customer products or services, special offers, benefits, and promotions by the Company, including offering products or services by its affiliates, group companies and business partners through the communication channels received from customers
To develop and improve products and services.	Conduct of marketing research, marketing analysis, and the development of products or services of the Company and its affiliates and group companies for better response to the customers and suit their demands.
To conduct data analytics.	Conduct of data analytics for any interests under the lawful purposes, e.g., the development of products and services of the Company and its affiliates and group companies, organizational risk management, fraud prevention.
To inspect and improve technology systems	Conduct of inspection and improvement of the Company’s technology systems in alignment with international standards and relevant regulations, e.g., the maintenance of security system, the inspection of technology systems, penetration test.
To investigate and prevent the violation of law.	Conduct of an investigation or any action to prevent any unlawful acts against the applicable law or any security breach having an impact to the Company and the data subjects.
To comply with applicable laws relating to the Company’s operations.	For the purposes of compliance with laws and regulations relating to the Company’s businesses, e.g., the remittance of withholding tax under the Revenue Code, the procedures of customer due diligence under the Anti-Money Laundering Law, regulations relating to insurance brokerage business, the Debt Collection Law, the Consumer Protection Law.
For regulating and promoting the insurance business in accordance with the law and the personal data protection policy of the Office of Insurance Commission.	Further details can be found at https://www.oic.or.th.
To provide information to government agencies as required by law or as requested by authority bodies.	Providing and clarifying information to regulators and lawful authorities or government agencies related to the Company’s business, e.g., the Office of Insurance Commission, the Bank of Thailand.
For the interests of the internal management of organization.	For the purposes of internal management within the organization in several matters, e.g., monitoring the compliance with the governance principles and code of conduct of the Company and its affiliates and group companies, organizational risk management, prevention of corruption and bribery in the organization.
For the interests of human resource management.	For the purposes of human resource management of the Company and its affiliates and group companies, e.g., recruitment process, criminal record check, wage and remuneration payment for employees, provision of employee’s welfare, appraisal of work performance or employee’s performance, review of employee’s performance, provision of insurance coverage to employees, prevention of infectious disease and epidemic disease, the compliance with the Occupational Safety, Health, and Environment Act, the compliance with the Civil Law on Partnerships and Companies.
For the purposes of conducting transactions by the Company.	For the purposes of conducting the transactions relating to the Company’s businesses, e.g., disposition of assets, procurement process, acquisition of business capital funds from domestic and overseas sources, securitization, the issuance of debt instruments, business transfer.
For the purposes of establishment of legal rights and legal proceeding.	For the purposes of dispute resolutions and judicial procedures, including the compliance with subpoenas, court orders, or arbitration awards.
For debt collection	Contacting for debt collection, debt restructuring, asset investigation and seizure, tracking assets obtained by customers from the company's services, regaining possession of the company's assets, selling debt, transferring customer history to debt buyers, including refunding money, and conducting auction processes.

3.2.2 The Company will collect personal data only as long as necessary for the fulfilment of the purposes in accordance with applicable laws, with data subjects notified prior to or at the time of collection of personal data. The Company shall obtain explicit consent from data subjects prior to or at the time of collection of personal data, except where the applicable law allows the Company to collect personal data without requesting consent. 

3.2.3     In case where it is necessary for the data subject to provide the Personal Data for the purpose of the compliance with applicable law or the performance of contract, or it is necessary for entering into the contract or any other purposes, a refusal of presenting the Personal Data may affect a transaction or any other activities relating to the data subject being suspended or ceased as required by business operation or laws, unless the data subject provides such data to the Company. In this case, the Company is no longer capable of carrying out such processing activity or is not lawfully permitted under the applicable to conduct the transaction or such activity. 

3.2.4    For the processing that requires consent, if the data subject decides not to provide it, no process of personal data will be carried out. The refusal to provide the consent will have no consequence on the subscription and execution of the contract between the data subject and the Company, nor will there be any negative consequence against the data subject, except where it is required by law to merely obtain consent for the processing activity. Moreover, the consent provided may be withdrawn at any time as easily as it was given. The withdrawal of consent shall not affect, in any case, the lawfulness of the processing carried out until that moment. 

 When collecting sensitive personal data, if it is not subject to the exceptions of law, the Company will obtain explicit consent from data subjects prior to or at the time of collection, in accordance with the Company's rules and in compliance with applicable laws. A data subject’s refusal to provide a consent may give rise to the restriction on access to certain services, which cannot rely on any other lawful basis than obtaining an explicit consent for processing of sensitive personal data. 

3.2.6 Personal data of minors, incompetent persons, and quasi-incompetent persons 

When collecting personal data of a minor, incompetent person, or quasi-incompetent person which requires consent, the Company will not carry out any processing of such person’s personal data, unless consented by the guardian who legally acts on behalf of the minor, incompetent person, or quasi-incompetent person, as the case may be, to the extent that it is permitted by the requirements of applicable law. 

If the Company is not knowingly aware that the data subject is the minor, incompetent person, or quasi-incompetent person, and it is found later that the collection of personal data has proceeded without legally obtaining consent form the guardian of such person, the Company will destroy or erase such personal data without delay, provided that there is no longer any other legitimate ground to rely on than the consent for data processing.

4. Use and disclosure of personal data

5. Period for personal data retention

The duration for which the Company stores personal data will be either one of the following: 

1. 5.1 Personal data will be kept for the periods stipulated by laws specifically relevant to retention of personal data such as the Accounting Act B.E. 2543 (2000), Anti-Money Laundering Act, B.E. 2542 (1999), Act on Commission of Offences Relating to Computer, B.E. 2550 (2007) and the Revenue Code. 
2. 5.2 In cases where the retention period for personal data is not specified by relevant laws, the Company will determine the period necessary and appropriate for its operations. 

At the end of such period or when the processing is no longer necessary, the Company shall delete, destroy, or anonymize the personal data

6. Transmission or transfer of personal data to other countries

The Company may transfer or transmit personal data collected from data subjects to its affiliates, group companies, or service providers located outside Thailand, e.g., the cloud computing servicers having servers located abroad (Singapore or Japan etc.), data processors, and Platform-as-a -Service providers (PaaS providers), for the purposes as stated in this Privacy Policy. In this regard, the Company will ensure that the destination country has sufficient personal data protection standards and the data subject’s rights are enforceable, and the Company shall arrange to have in place an adequate measure to ensure the security of such personal data transmission or transfer. 

However, in cases where the destination country does not have sufficient personal data protection standards, The Company will take appropriate measures to ensure that the transmission or transfer of such personal data will be proceeded with sufficient and appropriate safeguards pursuant to the Personal Data Protection Act B.E. 2562 and relevant laws.

7. Rights of Data subjects

This policy is established to assure data subjects that they can exercise the following rights available to them under the Personal Data Protection Act, B.E.2562 (2019) and relevant laws: 

1. Right to withdraw consent: The data subjects have the right to withdraw their consent for the processing of personal data that they have given to the Company throughout the period in which the personal data is kept by the Company. 

2. Right of access: The data subjects have the right to access their personal data and request the Company to make a copy of such data, including the right to ask the Company to disclose any acquisitions of their personal data for which consent has not been given.  

3. Right to rectification: The data subjects have the right to request the Company to rectify incorrect or incomplete data. 

4. Right to erasure: The data subjects have the right to request the Company to delete their personal data for certain reasons. 

5. Right to restriction of processing: The data subjects have the right to request the Company to restrict the use of their personal data for certain reasons. 

6. Right to data portability: The data subjects have the right to transfer personal data that they have provided to the Company to other Data Controllers or themselves for certain reasons. 

7. Right to object: The data subjects have the right to object to the processing of their personal data for certain reasons. 

However, the Company may refuse the exercising of the above rights by the data subjects, provided that the rejection is in accordance with the Company’s rules that are not in violation of the law. 

 The data subject is entitled to exercise the above rights by sending a request to the Company through the contact channels. The Company will respond to the data subject’s request not later than 30 (thirty) days as from the date of receiving the request. If the Company rejects a request, it will notify the data subject of the reason for the rejection. 

The data subject has the right to file a complaint to the supervisory authority in case where the Data Controller or the Data Processor, including its employees or service providers violates the Personal Data Protection Act B.E. 2562, or relevant laws.

8. Personal data security

The Company has established appropriate personal data security measures according to the framework for maintaining the confidentiality of systems and information (Confidentiality), the accuracy and reliability of systems and data (Integrity), and the readiness of information technology. (Availability) including system and data security (Safety) to prevent the loss of, unauthorized and unlawful access to, and the use, modification, correction or disclosure of personal data in accordance with the Company's policies and procedures and work system of information security which has considered the following issues 

(1) Design, development (Privacy by design), testing, and maintenance of business support systems, work systems related to service provision and other work systems are flexible and stable and safe for use in order to prevent risks that may arise from intrusion or threats. 

(2) Determining the authority and duties of personnel involved at all levels according to the principles of control, supervision, and inspection (3 lines of defense) in order to facilitate the maintenance of the security of personal data. 

(3) Controlling storage and access to personal data whereby considering the management of user rights according to the level of risk and necessity of use in an up-to-date information, including separating departments pursuant to Roles and Responsibility to restrict information access as necessity to complete their duty of such departments only. 

(4) Testing, detecting, and resolving problems of abnormal access to personal data or inappropriate use of personal data, including reporting to company top management in cases where access to personal data is detected or abnormal persons or improper use. 

(5) Determination, preservation, destruction, and encryption of data according to the level of confidentiality in order to maintain the security of personal data. 

(6) Controlling and managing external service providers, agents, business support service providers, including business partners to access, use, edit, and change personal data efficiently and securely. 

(7) Raising and promoting awareness for employees at all levels to understand the importance of maintaining the security of personal data. 

In case where the Company has engaged an agency or a third party to perform work related to the collection, use or disclosure of personal data of the data subjects, it will require the agency or the third party to keep the personal data confidential and secure, and to prevent the collection, use or disclosure of such personal data for any purposes other than specified in the scope of engagement or for any unlawful purposes.

9. Linking to third parties’ websites or services

The Company’s services may be linked to third parties’ websites or services, where the terms of privacy policy will be different from the Privacy Policy of the Company. Therefore, the data subject must read and study the privacy policy of such website or service prior to any access. The Company will not be involved in or have any authorization to control the privacy policy of third party’s website or service and will not be responsible for any content, damage, or action as a result of accessing such website or service.

10. Third-party servicers or sub-servicers

The Company may delegate or engage a third party (as a data processor) to process personal data on the Company’s behalf, where the services performed by such third party may vary in types, e.g., hosting services, outsourcing services, cloud computing services, IT system services, Artificial Intelligence services, support services, or internal management services (such as the operational process relating to vehicle registration, debt collection, customer information service, payroll management, conduct of surveys, customer data analysis) 

Any delegation to a third party for processing personal data on the Company’s behalf, as the data processor, the Company will require such third party to enter into an agreement specifying the obligations and duties of the contract parties. Thus, the third party will act as the data processor which carries out processing activities of personal data only under the Company’s instruction and is not allowed to proceed further than the authorized scope of such agreement with the Company. 

In case where the data processor delegates any sub-servicer (as a sub data processor) to perform the processing activities on the data sub processor’s behalf, the Company will take appropriate steps to require the data processor to execute the legal arrangement with such sub data processor in which the requirements and standards must not be less than those prescribed in the agreement between the Company and the data processor.

11. Policy review and improvement

     The Company shall review and update this policy at least once a year, or when any change with a significant impact on the policy occurs. 

12. Contact information

Details of Data Controller

Name:	Toyota Leasing (Thailand) Co., Ltd.
Address:	No. 990, 18th, 19th Fl. Abdulrahim Building, Rama 4 Road, Silom, Bangrak, Bangkok 10500
Channels of contact:	1486   https://www.tlt.co.th/ [Other channels for contact or news updates include LINE, Facebook]

Details of Data Protection Officer

Name:	Group of Data Protection Officer
Address:	No. 990, 18th, 19th Fl. Abdulrahim Building, Rama 4 Road, Silom, Bangrak, Bangkok 10500
Channels of contact:	1486