OrbitInnotive Company Limited recognizes the importance of protecting personal data. Therefore, we have developed a Personal Data Protection Policy to explain how the company handles personal data, including data collection, storage, usage, disclosure, and the rights of individuals whose personal data is involved. This policy aims to ensure that data owners are informed about the company’s personal data protection practices. Therefore, the company hereby announces the following Personal Data Protection Policy.

1. Definitions
• “Company” is an abbreviation for OrbitInnotive Company Limited
• “Personal data” refers to information about an individual that may be used to directly or indirectly identify that person, but it does not expressly apply to information on deceased individuals

2. General provisions
This policy explains how the company manages personal data that may or may not directly identify you, in accordance with applicable data protection laws (“personal data”). It covers any operation involving personal data, such as collection, usage, disclosure, and processing, as well as informing you about the purposes of processing personal data, the retention period of personal data, and your rights as the data owner. To ensure that you have a comprehensive understanding of these details as required by data protection laws, the company recommends that you read and understand the provisions under this policy in detail.

3. Who does the company collect personal data from?
This policy specifies the collection and processing of personal data of customers, service users, website visitors, application users, activity participants, individuals who contact the company for inquiries or to request information or services from the company, and includes other individuals who have a similar relationship with the company. In the case of legal entities, it refers to individuals associated with or acting on behalf of such legal entities.

4. How does the company collect personal data?
The company may collect personal data from you through various channels, including:
4.1 When you provide personal data directly to the company
4.1.1 When you contact or register as a member to purchase or use products or services offered by the company by providing various information through forms, whether in document format, through websites, applications, online social media, or any other channels.
4.1.2 When you place an order or purchase products from the company.
4.1.3 When you make a reservation or use services provided by the company.
4.1.4 When you submit documents containing personal data to the company.
4.1.5 When you communicate, inquire, provide feedback, or give comments to the company through various channels such as websites, applications, and online social media of the company.
4.1.6 When you sign up for or participate in events, marketing activities, or other activities organized by or on behalf of the company.
4.1.7 When you subscribe to newsletters or promotional materials from the company.
4.2 When the company receives personal data from external parties
4.2.1 When companies within the business group, affiliates, partners, or business counterparts of the company provide your personal data to the company for the purpose of offering and/or providing services to you and conducting related business activities.
4.2.2 When service providers send your personal data to the company for the purpose of providing services to you as assigned by the company.
4.2.3 In some cases, the company may collect your personal data from public sources or commercial data sources, whether you have voluntarily disclosed such personal data yourself or have given consent to third parties to disclose your personal data, such as on the company’s website, government agencies, information obtained through internet searches, or on various online social media platforms.
4.3 When the company automatically collects personal data
4.3.1 When you visit and/or use websites, applications, or online services that use cookies or similar technologies to collect technical data regarding your usage details.
When collecting your personal data, you will receive notifications regarding the details specified in this policy, such as the purposes and legal bases for processing personal data, or in cases where data protection laws require specific consent for certain types of personal data processing, the company will request your explicit consent.

5. What personal data does the company collect?
In the course of the company’s business operations and under this policy, the personal data that the company collects or may collect includes personal data that you provide directly to the company, personal data that the company receives from external individuals, or personal data that the company collects automatically from you. This personal data includes the following:
5.1 Personal information
Such as name, surname, date of birth, age, gender, nationality, religion, occupation, job position, photograph, national identification number, passport number, signature, and workplace address, among others.
5.2 Contact information
Mobile phone number, home phone number, work phone number, home fax number, work fax number, email address, online social media accounts, address on the national identification card, residential address, work address, shipping address, invoice delivery address, and contact information of individuals who can be reached, among others.
5.3 Information about the use of various membership systems
Such as information that you provide during registration as a member and when using the company’s services, including account username (Account ID), user account information, password, account details modification history, information about purchasing behavior or trends, records of system logins, visitation time, search data, and opinions about products and/or services, among others.
5.4 Information about transactions for the purchase of goods and use of various services
Such as details of orders (e.g., online courses, training programs, consulting programs) and details of service usage (e.g., desired service date, number of service users, desired services), among others.
5.5 Financial information
Such as bank account numbers, credit card or debit card numbers, payment terms, income, sources of income, personal information shown on invoices, tax receipts, receipts, and details or information about other payment transactions, among others.
5.6 Information used as evidence for various transactions
Such as personal information shown on copies of the identification card, copies of passports, copies of civil servant cards, copies of state enterprise employee cards, copies of residential registration certificates, copies of name change certificates, power of attorney documents, copies of company certification (in the case of corporate clients), medical certificates, delivery notes, and purchase agreements or other related agreements, among others.
5.7 Technical data
Such as computer traffic data (logs) and data collected by the company through cookies or similar technologies, such as website and application usage data, device identifiers, computer IP addresses, location data, browser types, and usage behavior, among others.
5.8 Other data
Such as telephone conversation recordings and image recordings, among others.
In some cases, the company may collect sensitive personal data about you. In such cases, the company will process sensitive personal data only with your consent or as required by applicable data protection laws.

6. Purposes of collecting personal data for use or disclosure:
The company collects, uses, or discloses your personal data for the following purposes:
6.1 The company collects your personal data for the purpose of creating a database for analysis and presenting benefits based on your interests.
6.2 The company collects your personal data for the purpose of processing payments for services or products you purchase within the system.
6.3 The company collects your personal data for the purpose of receiving post-service information, such as surveys, feedback, or submitting requests to the service provider.
6.4 The company collects your personal data for market research and managing relationships between service providers and users.
6.5 The company collects your personal data to comply with laws and regulations imposed by the government.
6.6 The company collects your personal data to comply with regulations applicable to the service provider, including consent to transfer personal data to business partners, data processors, or any other entities with a contractual relationship with the service provider.

7. Parties with whom the company discloses personal data:
7.1 The company may disclose your personal data, based on specified purposes and legal criteria, to the following individuals and organizations
7.1.1 Executives, board members, employees, and/or personnel within the company to the extent relevant and necessary for processing your personal data.
7.1.2 Consultants of the company, such as auditors, legal advisors, lawyers, or any other experts both within and outside the company.
7.1.3 Partners, business partners, service providers, and data processors appointed or hired by the company to manage and/or process personal data for the benefit of the company’s business operations. This may include payment services, postal and courier services, printing services, IT services, website services, data storage services, data analysis services, research services, marketing services, travel services, or any other services that may be beneficial to you or related to the company’s business operations.
7.1.4 Government agencies responsible for regulatory oversight under the law or requesting the disclosure of personal data based on legal authority or related to legal proceedings or authorized under relevant laws, such as the Customs Department, Revenue Department, Department of Airports, Bank of Thailand, Civil Aviation Authority of Thailand, Office of Trade Competition Commission, Personal Data Protection Committee, National Police Office, Office of the Attorney General, and the courts.
7.1.5 Company’s websites, applications, and/or online social media platforms.
7.1.6 Individuals or other entities to whom you have given consent to disclose your personal data.
7.2 When disclosing personal data to others, the company will implement appropriate measures to protect the disclosed personal data and comply with the standards and obligations for personal data protection as provided by law. If the company sends or transfers your personal data abroad, the company will ensure that the destination country, organization, or data recipient has sufficient data protection standards or complies with the criteria prescribed by the laws governing personal data protection. In some cases, the company may request your consent for the transfer or disclosure of your personal data to other countries.
7.3 The disclosure of your personal data to others will be carried out only for the purposes specified by law or other legally prescribed purposes. In cases where the law requires your consent, the company will request your consent before disclosing or transferring your personal data.

8. Duration of Personal Data Retention
8.1 The company will retain your personal data for a necessary period to achieve the specified purposes of processing such personal data. The duration of personal data retention may vary depending on the purposes specified for processing such personal data and taking into account the following factors:
8.1.1 Duration as required by relevant laws (if applicable).
8.1.2 Statutory limitation periods for potential legal proceedings arising from or related to documents or personal data collected by the company in each case.
8.1.3 Best practices of the company and relevant business sectors for each type of personal data. However, the company will retain your personal data for a period not exceeding 5 years from the date of the transaction or legal relationship between you and the company, unless the company is authorized by law or the retention of such personal data is necessary for the establishment, exercise, or defense of legal claims by the company.
8.2 After the aforementioned specified duration, the company will delete or destroy such personal data from its systems and those of service providers (if any), or render your personal data unidentifiable, unless the company is permitted by applicable data protection or other relevant laws to continue retaining such personal data. For further details regarding the duration of personal data retention, you may contact the company as specified in Clause 10 of this Privacy Policy.

9. Rights of Data Subjects
Data subjects have the following rights:
9.1 Right to withdraw consent: You have the right to withdraw your consent for the processing of personal data provided. However, the withdrawal of consent does not affect the legality of the collection, use, or disclosure of personal data based on the previously given consent.
9.2 Right to access personal data and request copies of personal data, including the disclosure of non-consented personal data.
9.3 Right to rectify inaccurate personal data.
9.4 Right to erase personal data.
9.5 Right to suspend the use of personal data.
9.6 Right to data portability.
9.7 Right to object to the processing of personal data.

10. Contacting the Company
If you have any questions regarding this Privacy Policy or wish to exercise your rights as specified in this Privacy Policy, please contact:

Public Relations Officer
OrbitInnovative Company Limited
Contact Number: 0926668871 (Monday – Friday: 09:00 am – 05:00 pm, excluding public holidays)
Email: info@orbit-people.com

11. Changes to This Policy
The company may amend this Privacy Policy to align with any changes related to the processing of your personal data as required by applicable data protection or other relevant laws. The company will notify you of any significant changes to this Privacy Policy through appropriate channels. It is recommended that you periodically review this Privacy Policy. This Policy shall be effective from 1st May 2021.