TH
Revised on 22 May 2023 (B.E. 2566)
Nim Express Company Limited (hereinafter referred to as the "Company") respects the privacy rights of its customers, both individuals and juristic persons (hereinafter referred to as "you"), including your authorized representatives, personnel, and employees. To ensure that you receive proper protection of your personal data, the Company has established this Privacy Notice to inform you of the details relating to the collection, use, and disclosure (collectively, "Processing"), as well as the deletion and destruction, of your personal data, through both online and other channels, in accordance with the personal data protection law. The essential contents of this Notice are summarized as follows:
What Is the Purpose of This Notice?
This Notice is intended to inform you, as the data subject, of the purposes and details of the collection, use, or disclosure of personal data, as well as your legal rights relating to personal data.
"Personal Data" means information relating to a person that enables the identification of that person, whether directly or indirectly. This refers only to information relating to a natural person, such as first name and surname, date of birth, age, national identification card number, passport number, address, contact information (email and telephone number), bank account information, and sensitive personal data, such as facial recognition data, criminal record data, fingerprint data, and religious data. It does not cover information relating to juristic persons or deceased persons.
Under this Personal Data Notice, the Company collects the personal data of the following persons:
"Business Partner" means an individual or juristic person, including one or more individuals who have the authority or are assigned to act on behalf of a juristic person, to enter into a business contract with the Company as a Business Partner — whether as a supplier, seller, buyer, service provider, service recipient, employer, contractor, lessee, or lessor of premises — and includes any staff or persons whom the Business Partner has assigned to liaise with the Company for the purposes of, or in connection with, that business contract.
The Company will collect, gather, and use your personal data only where the Company has a proper and reasonable ground to do so, and will disclose personal data to external parties on the basis of the following legal grounds: the legitimate interest basis, the legal obligation basis, the contractual basis, and the consent basis.
| No. | Purpose | Legal Basis |
|---|---|---|
| 1 | To develop services in various areas, such as the delivery of parcels and products, providing assistance, and handling your complaints more efficiently | Legitimate interest |
| 2 | For the purpose of evaluating, improving, and developing the Company's products, services, and promotional campaigns, including conducting satisfaction surveys regarding the Company's products and services, so that they are suitable for and responsive to your needs | Legitimate interest |
| 3 | To use as information and supporting documents for any dealings with banks, financial institutions, the Department of Business Development, the Revenue Department, the Excise Department, and other relevant external agencies | Legal obligation |
| 4 | To carry out business planning, reporting and forecasting, risk management, and audit governance, including the internal audit conducted by the Internal Audit Office, and internal organizational management, including for the Company's internal operations relating to disbursements by its finance and accounting department | Legitimate interest |
| 5 | To develop the Company's online service channels so that you receive services from the Company that are of high quality, fast, and as convenient as possible | Legitimate interest |
| 6 | To develop marketing policy and effectiveness, including preparing, analyzing, and improving the Company's marketing plans | Consent |
| 7 | To carry out pre-contractual procedures, such as Business Partner registration, consideration of Business Partner qualifications, preparation of information prior to the procurement process (e.g. identifying the Business Partner's name and details in the Company's internal system), purchasing or receiving bid documents, attending clarification sessions, presenting work related to procurement (as applicable), price negotiation, and announcement of the winning bidder | Contractual obligation |
| 8 | For necessary transactions between the Business Partner and the Company, such as identity verification, authority verification, and the granting and receiving of powers of attorney, as well as for use as evidence supporting related transactions, and compliance with the Company's internal rules, regulations, and procedures for the consideration, preparation, and signing of related contracts or memoranda of agreement, including the administration of such contracts or agreements | Contractual obligation / Legal obligation / Legitimate interest |
| 9 | For qualification checks or suitability assessments prior to deciding to enter into a transaction, consideration of the risks of the relevant transaction, identity proofing and verification, and/or verification of authority and the granting and receiving of powers of attorney to sign any agreement or contract with the Company, business status checks or other forms of background checks, and compliance with the Company's various internal procedures | Legitimate interest |
| 10 | To resolve disputes or potential disputes between the Company and you relating to the Company's provision of services | Legal obligation |
| 11 | To comply with the law, conduct investigations and inquiries in accordance with legal processes and other regulations, and to report or disclose information to government agencies or other organizations acting under legal authority or the orders of the police, public prosecutors, and courts, as well as to establish, comply with, exercise, or defend legal claims | Legal obligation |
Where the personal data collected by the Company for the above purposes is data necessary for compliance with a contract or with applicable law, if you do not provide such necessary personal data, the Company may be unable to consider entering into a transaction with you, or to administer the contract with you, as the case may be.
In addition, where you provide us with the personal data of another person, you are responsible for informing that person of this Personal Data Notice and/or obtaining their consent (where necessary).
Generally, in collecting your personal data, the Company will collect personal data by requesting or asking for such information directly from you. However, in certain cases, the Company may collect your data from other sources, such as your affiliated company, your employees, secretary, or coordinator acting on your behalf, government agencies or state authorities, or other publicly available sources, such as websites or information searchable on the internet. The Company collects your personal data as follows:
4.1 General Personal Data
4.2 Sensitive Personal Data
In general, the Company does not intend to collect or use the religion and blood-type information shown on the copy of your national ID card for any specific purpose. If you provide the Company with a copy of your national ID card, please redact such information. If you do not redact the above information, you are deemed to authorize the Company to redact it on your behalf, and the document with such information redacted shall be deemed complete and fully enforceable under law. The Company will collect and use such data only as part of your identity verification documents.
Where the Company is required to collect your sensitive personal data, the Company will seek your explicit consent on a case-by-case basis, except where the law permits such use without consent.
Generally, the Company collects your personal data by requesting it directly from you. However, there may be certain cases where the Company collects your personal data from other sources in order to achieve the purposes described above. The Company may receive your personal data through the following channels:
Received directly from the data subject, whereby the Company collects the data subject's personal data as follows:
The Company will notify the data subject and obtain the data subject's consent to the collection of such personal data. If the data subject cannot be contacted, the Company will notify the data subject no later than the first occasion on which contact can be made, except where an exemption from the requirement to obtain consent or provide notice applies under law.
Under the purposes set out in Section 5 above, the Company may disclose your personal data to the following persons. The categories of data recipients listed below represent only a general framework for the Company's disclosure of personal data; only the data recipients relevant to the products or services you use or with which you have a relationship shall apply.
| Category of Recipient | Details |
|---|---|
| Actions in the public interest | Such as the Cabinet, the responsible Minister, the Department of Provincial Administration, the Revenue Department, the Royal Thai Police, the courts, the Office of the Attorney General, the Department of Disease Control, the Ministry of Digital Economy and Society, the Office of the Permanent Secretary to the Prime Minister, the Department of Consular Affairs, and the Student Loan Fund. |
| Committees involved in the Company's legal compliance | The Company may disclose your data to persons holding committee positions on various boards, such as the recruitment subcommittee and the Digital Government Development Agency committee. |
| Counterparties handling the welfare of the Company's personnel | External parties engaged by the Company to manage welfare benefits, such as insurance companies, hospitals, payroll service providers, banks, and telephone service providers. |
| Business partners | The Company may disclose your data to parties collaborating with the Company for the purpose of providing services to you, such as service providers you contact through the Company's services, marketing service providers, advertising media, financial institutions, platform providers, and telecommunications service providers. |
| Service providers | The Company may engage other persons to act as service providers on its behalf, or to support its operations, such as data storage providers (e.g. cloud services, document warehousing), system/software/application/website developers, document delivery providers, payment service providers, internet service providers, telephone service providers, Digital ID service providers, social media service providers, risk management service providers, external consultants, and transportation providers. |
| Other categories of recipients | The Company may disclose your data to other categories of recipients, such as persons contacting the Company, family members, non-profit foundations, temples, hospitals, educational institutions, or other organizations, for purposes relating to the Company's services, training, receiving awards, and participating in merit-making or charitable donations. |
| Public disclosure | The Company may disclose your data to the public where necessary, such as where the Company is required to publish an announcement in the Royal Thai Government Gazette or a Cabinet resolution. |
In certain cases, the Company may need to send or transfer your personal data abroad in order to carry out the purposes of providing services to you, such as sending personal data to a cloud system whose platform or servers are located abroad, in order to support information technology systems located outside Thailand. This depends on the particular Company service you use or are involved with.
However, at the time this Notice was prepared, the Personal Data Protection Committee had not yet issued a notification listing destination countries with adequate personal data protection standards. Accordingly, where the Company needs to send or transfer your personal data to a destination country, the Company will take steps to ensure that the personal data sent or transferred is subject to adequate personal data protection measures in accordance with international standards, or will comply with the conditions enabling the data to be lawfully sent or transferred, including:
The Company will retain your personal data for as long as is necessary for the purposes of collecting, using, or disclosing personal data as set out in this Notice. The criteria used to determine the retention period include the period during which the Company still needs to use your personal data for such purposes, and the data may continue to be retained for the period necessary to comply with the law or the applicable statute of limitations, to establish, comply with, exercise, or defend legal claims, or for other reasons under the Company's internal policies and requirements.
The Personal Data Protection Act is intended to protect the privacy of your personal data and to give you greater control over it. You may exercise your rights under the Personal Data Protection Act, the details of which are set out below, through the channels designated by the Company. (The processing period for exercising the various types of rights is within 30 days, counted from the date the Company issues a written acknowledgment of the request.)
9.1 Right to Access and Obtain a Copy of Your Personal Data
You have the right to access and obtain a copy of your personal data held by the Company, or to request disclosure of how such personal data was obtained where you believe you did not give consent to its collection, except where the Company is entitled to refuse your request under law or a court order, or where your request would have an impact that may cause damage to the rights and freedoms of other persons.
9.2 Right to Correct Your Personal Data
You have the right to request that the Company correct or update your personal data that is inaccurate or incomplete.
9.3 Right to Request Deletion of Your Personal Data
You have the right to request that the Company delete or destroy your data, or render it unable to identify you, except where the Company has a lawful ground to refuse your request.
9.4 Right to Request Restriction of the Use of Your Personal Data
You have the right to request that the Company restrict the use of your personal data in cases prescribed by law, such as:
9.5 Right to Object to the Collection, Use, or Disclosure of Your Personal Data
You have the right to object to the collection, use, or disclosure of your personal data where the Company processes such data on the legitimate interest basis, or for the purposes of direct marketing, or scientific, historical, or statistical research, except where the Company has a lawful ground to refuse your request (for example, where the Company can demonstrate that the collection, use, or disclosure of your personal data is based on a compelling legitimate ground, or is necessary to establish, comply with, exercise, or defend a legal claim, or is for the public interest).
9.6 Right to Receive, Send, or Transfer Your Personal Data
You have the right to receive your personal data where the Company is able to organize such data into a format that is generally readable or usable by automated tools or devices, and that can be used or disclosed by automated means. You also have the right to request that the Company send or transfer your personal data to a third party, or to receive personal data that the Company has sent or transferred to a third party, except where this is not technically feasible for the Company, or where the Company has a lawful ground to refuse your request.
9.7 Right to Withdraw Consent
You have the right to withdraw the consent you have given to the Company at any time, in accordance with the procedures and methods established by the Company. The Company will inform you of the consequences of withdrawing such consent, except where consent cannot be withdrawn due to legal restrictions on the right of withdrawal. Withdrawal of your consent will not affect the collection, use, or disclosure of your personal data that was lawfully carried out based on your consent prior to such withdrawal.
You may notify the Company of your intention to exercise your right to verify and change your consent to the use or disclosure of personal data for various purposes through the channels for exercising your rights specified below.
9.8 Right to Lodge a Complaint with the Expert Committee
You have the right to lodge a complaint with the Expert Committee if you believe that the Company has violated or failed to comply with the Personal Data Protection Act. You may notify your intention to exercise this right to complain to the Expert Committee through the channels for exercising your rights specified at the end of this document.
The Company retains the right to continue collecting and using your personal data that was collected before the provisions of the Personal Data Protection Act relating to the collection, use, and disclosure of personal data came into force, for the original purposes for which it was collected.
If you do not wish the Company to continue collecting and using such personal data, you may notify the Company to withdraw your consent at any time through the channels for exercising your rights specified below.
The Company has implemented appropriate security measures for personal data, covering administrative, technical, and physical safeguards relating to access to, or control of access to, personal data, in order to maintain the confidentiality, integrity, and availability of personal data, and to prevent the loss of, unauthorized or unlawful access to, use of, alteration of, correction of, or disclosure of personal data, in accordance with applicable law.
The Company has implemented controls over access to personal data and the use of devices for storing and processing personal data that are secure and appropriate for the collection, use, and disclosure of personal data. The Company has also established measures to restrict access to personal data and the use of storage and processing devices, by defining users' data access rights, the right to authorize designated persons to access data, and the duties and responsibilities of users, in order to prevent unauthorized access to, disclosure of, or unauthorized knowledge of personal data, unauthorized copying of personal data, or theft of devices used to store or process personal data. In addition, the Company has established measures for the retrospective audit of access to, alteration of, deletion of, or transfer of personal data, appropriate to the methods and media used to collect, use, or disclose personal data.
The Company will regularly review this Privacy Notice to ensure it remains consistent with applicable practices and regulations. This Notice will be reviewed at least once a year. Where this Notice is amended, updated, or changed, the Company will publish the current version to notify you via www.nimexpress.com.
Name: Personal Data Working Team
Contact Address: Nim Express Company Limited, Rama 9 Branch, 19/28-30 Soi Sunvijai, Bang Kapi, Huai Khwang, Bangkok 10310, Thailand
Contact Channel: Call Center 02-096-3333 or 090-554-1988
Email: callcenter@nimexpress.com
Office of the Personal Data Protection Committee
Tel: 061-675-5153, 061-675-5154
Email: pdpc@mdes.go.th
Language Notice
This Privacy Notice has been originally prepared in the Thai language in accordance with the laws of the Kingdom of Thailand. The English version is a translation prepared solely for the convenience of non-Thai speaking persons. In the event of any inconsistency, ambiguity, discrepancy, or conflict between the Thai version and the English version, the Thai version shall prevail, govern, and be deemed the official and legally binding version in all respects.