Privacy Notice
For Activity Participants and Liaisons
The Thai General Insurance Association (hereinafter referred to as “the Association”) recognizes the importance of Personal Data protection and is committed to protecting the Personal Data of Data Subjects in accordance with the Personal Data Protection Act B.E. 2562. The Association has, therefore, prepared this Privacy Notice (hereinafter referred to as “the Notice”) to inform you of details related to the collection, use, and/or disclosure of Personal Data, including legal rights as a Data Subject, with the following details:
1. Definitions
“Personal Data Protection Law” refers to the Personal Data Protection Act B.E. 2562 and any future amendments, including related rules, regulations, and orders.
“Personal Data” refers to information relating to an Individual that can identify that Individual, directly or indirectly, but does not include information of deceased persons.
“Sensitive Personal Data” refers to Personal Data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability data, trade union data, genetic data, biometric data, or any other data similarly affecting the Data Subject as announced by the Personal Data Protection Committee.
For the purpose of this Notice, unless specifically stated otherwise, “Personal Data” and “Sensitive Personal Data” related to Individuals will collectively be referred to as “Personal Data”.
“Individual” refers to a living natural person.
“Processing” refers to the collection, use, or disclosure of Personal Data.
“Association” refers to the Thai General Insurance Association.
“Data Subject” refers to the Individual to whom the Personal Data identifies.
2. Scope of Application
This Privacy Notice applies to you as:
2.1 An Activity participant, which includes participants in meetings, seminars, training, or any other Activities organized by the Association (hereinafter referred to as “Activity” or “Activities”).
2.2 A liaison of Individuals in 2.1.
Hereinafter, you will be referred to as “You” or “Data Subject”.
3. Personal Data Collected by the Association
The Association will collect the following Personal Data to the extent necessary for the purposes detailed within this Notice:
| Types of Personal Data | Examples of Personal Data Collected |
| Basic Personal Data | Name, Surname, National identification number, Still images, Audio, Moving images, Signature, Gender, Date of Birth, Age |
| Employment Information | Position, Affiliated unit, Company |
| Contact Information | Address, Phone number, Email |
| Financial Information | Tax identification number |
| Qualification Data | Education history |
| Sensitive Personal Data | Food allergies or dietary restrictions based on beliefs |
| Document Copies | Copy of national identification card, Copy of passport |
| Other Information | Username, Password, Exam results, Training results |
When the Association collects a copy of your national identification card for purposes such as identity verification in transactions, we may incidentally receive religious information present on the card. However, the Association has no intention or policy to collect your religious information and does not process it further.
4. Sources of Personal Data
The Association collects your Personal Data from various sources, as follows:
4.1 Personal Data received directly from you, such as from filling out information on the website event.tgia.org, Google Forms, via national identification card readers, Personal Data received during Association Activities, from communicating with the Association through various channels such as email, telephone, etc.
4.2 Personal Data received from other sources, such as employers, representatives, authorized persons, liaisons, secretaries, assigned persons, or your contact persons, government documents, or public data sources such as websites of listed companies or government agency websites, etc.
5. Purpose of Collection and Use of Personal Data
The Association processes Personal Data for the following purposes and relies on the
following legal bases for processing your Personal Data:
| Purpose | Types of Personal Data | Legal Basis |
| To process your Personal Data for operations related to the organization of Association Activities, including the following purposes: (1) To register for participation in Activities. (2) To verify and confirm the list of Activity participants. (3) To prepare food and snacks during Activities. (4) To issue certificates of attendance or other related documents. (5) To announce exam results. | (1) Basic Personal Data (2) Employment Information (3) Contact Information (4) Sensitive Personal Data (5) Other Information | (1) Legitimate interest of the Association (2) Explicit consent (3) Official authority |
| To enter contracts or any legal relationships with you, such as preparing invoices, issuing tax invoices, and/or receipts. | (1) Basic Personal Data (2) Financial Information (3) Contact Information | (1) Performance of a contract (2) Legitimate interests of the Association |
| To process Personal Data for the following purposes: (1) To create summaries of Activity participants’ information for use in diverse projects and for compiling alumni directories. (2) To serve as a central hub for sending and receiving documents between member companies and the Association. (3) To verify identity and carry out Activities related to verification | (1) Basic Personal Data (2) Employment Information (3) Contact Information (4) Sensitive Personal Data (5) Document Copies | Legitimate interests of the Association |
| To disseminate still images and moving images of meetings, training, seminars, or other Association Activities on the Association’s website, social media, or other websites, etc. | (1) Basic Personal Data | Legitimate interests of the Association |
| To promote Association Activities before and after they are held. | (1) Basic Personal Data (2) Contact Information | Legitimate interests of the Association |
| To carry out operations for organizing Activities abroad, including the following purposes: (1) To send your information to event organizers abroad. (2) To book hotels and airline tickets. | (1) Basic Personal Data (2) Employment Information (3) Contact Information (4) Sensitive Personal Data (5) Document Copies | Legitimate interests of the Association |
| To process your Personal Data for security within the Association’s building as follows: (1) To record CCTV footage within the Association’s premises. (2) To record entry and exit data for the Association building | (1) Basic Personal Data (2) Employment Information | Legitimate interests of the Association |
| To coordinate, contact and send information to the relevant agencies. | (1) Basic Personal Data (2) Contact Information | Legitimate interests of the Association |
If you do not provide your Personal Data to the Association, the Association may be unable to process your request or fulfill its contractual obligations. As a result, you may not receive certain services or benefits, and this may lead to inconvenience, potential loss or missed opportunities. In some cases, the failure to provide such information may also affect compliance with legal obligations applicable to either you or the Association, potentially resulting in associated penalties.
6. Disclosure of Personal Data
To achieve the purposes stated in this Privacy Notice, your Personal Data may be disclosed or transferred to various departments within the Association and external Individuals or entities, as follows:
6.1 Within the Association: The Association may disclose or transfer your Personal Data to relevant departments within the Association only as necessary for the purposes stated in this Notice. Access to your Personal Data is limited to authorized individuals or departments within the Association, as necessary and appropriate for their duties.
6.2 Outside the Association: The Association may disclose or transfer your Personal Data to external Individuals and/or organizations, as follows:
6.2.1 Government agencies, regulatory agencies, or other agencies as prescribed by law, such as the Thai Chamber of Commerce, the Office of Insurance Commission, the Anti-Money Laundering Office, the Delegation of the European Union to Thailand, the Ministry of Public Health, the Police, the Department of Consular Affairs, etc.
6.2.2 Partners
6.2.3 Sponsors
6.2.4 Third-party service providers, such as speakers, printing houses, document and parcel delivery service providers, information technology service providers, event venue providers, travel management services, hotels, airlines, etc.
6.2.5 Member companies
6.2.6 The general public and visitors to social media, applications, and/or other websites.
7. Cross-border Transfer of Personal Data
In the event that your Personal Data is transferred overseas, the Association will comply with the Personal Data Protection Law and take appropriate measures to ensure that your Personal Data is protected and you can exercise your rights related to your Personal Data in accordance with the law. This includes requiring recipients of the Personal Data to have appropriate measures to protect your Personal Data and to process such Personal Data only as necessary, and to take action to prevent unauthorized Individuals from using or disclosing Personal Data without improper authorization. In some cases, the Association may obtain your consent for transferring your Personal Data abroad.
8. Retention of Your Personal Data
The Association will retain your Personal Data for as long as necessary, considering the necessity and purposes for which the Association must collect, use, and process it, including compliance with applicable legal requirements, as follows:
8.1 For Activity participants, the Association will retain your data for a period not exceeding 2 years from the date the Activity ends.
8.2 For personnel of member companies, the Association will retain your data for as long as the data is necessary for the purpose of collection.
8.3 For liaisons, the Association will retain your data for no more than 6 months after a change in the list of liaisons has been notified.
Upon the expiry of the Personal Data retention period specified above, the Association will delete, destroy, or anonymize such Personal Data so that it can no longer identify the Data Subject.
9. Security Measures
The Association has implemented appropriate security measures to prevent Personal Data breaches, and the Association takes the following actions:
9.1 We control access to Personal Data and critical information system components through identity verification, authentication, and appropriate authorization. Access rights are granted based on the need-to-know and least privilege principles.
9.2 We manage user access comprehensively, including registration and de-registration, provisioning access, handling privileged access rights, managing user authentication credentials, regularly reviewing user access rights, and removing or adjusting access as needed.
9.3 We assign clear user responsibilities to prevent unauthorized or unlawful access, use, alteration, modification, deletion, or disclosure of Personal Data. This includes preventing actions beyond assigned duties, unauthorized copying of Personal Data, and theft of Personal Data storage or processing devices.
9.4 We provide methods for auditable traceability of Personal Data access, alteration, modification, or deletion. These methods are appropriate for how the Personal Data is collected, used, or disclosed.
9.5 We requires all personnel involved with Personal Data to prioritize and ensure its collection, use, or disclosure strictly adheres to the Association’s Personal Data protection policies and guidelines.
10. Data Subject Rights
You have rights under the Personal Data Protection Law to take the the following actions:
10.1 Right to Withdraw Consent: If you have given consent to the Association to collect, use, and/or disclose your Personal Data (whether consent given before or after the Personal Data protection law came into force), such withdrawal of consent will not affect the collection, use, or disclosure of Personal Data for which you have already given consent.
10.2 Right to Access Personal Data: You have the right to access and obtain a copy of your Personal Data, including requesting the Association to disclose the acquisition of Personal Data in the possession of the Association.
10.3 Right to Data Portability: You have the right to request your Personal Data in a format that is readable or usable by automated tools or devices, and can be used or disclosed by automated means, as well as the right to request the Association to send or transfer the Personal Data in such form to another Data Controller when it can be done by automated means, and the right to request the Personal Data that the Association sends or transfer the Personal Data in such form directly to another Data Controller, unless it is not possible to do so for technical reasons.
10.4 Right to Object: You have the right to object to the collection, use, and/or disclosure of your Personal Data at any time, in cases as prescribed by law.
10.5 Right to Erasure: You have the right to request the deletion or destruction of your Personal Data or to anonymize your Personal Data.
10.6 Right to Restriction of Processing: You have the right to request the temporary restriction of the use of Personal Data in cases where the Association is investigating your request for rectification or objection, or in any other case where the Association no longer needs to keep and must delete or destroy your Personal Data according to relevant laws, but you request the Association to restrict its use instead.
10.7 Right to Rectification: You have the right to request the Association to rectify your Personal Data to be accurate, current, complete, and not misleading.
10.8 Right to Lodge a Complaint: You have the right to lodge a complaint with the authority if you believe that the collection, use, and/or disclosure of your Personal Data is in violation of or non-compliance with Personal Data Protection Law.
You can request to exercise your legal rights by contacting channels provided in Section 12. Your exercise of the aforementioned rights may be limited under relevant laws, and there may be cases where the Association may refuse or be unable to comply with your request for the above rights. If the Association refuses the above request, the Association will inform you of the reasons for the refusal.
11. Changes to the Privacy Notice
The Association will regularly review this Notice to ensure compliance with the relevant guidelines, laws and regulations. If there are any significant amendments to this Notice, the Association will inform you of such amendments to the Privacy Notice along with the updated Privacy Notice through appropriate channels. Nevertheless, we recommend that you periodically check for changes to this Privacy Notice.
12. Contact Channels
If you wish to contact or inquire for more information about Personal Data protection or your rights as a Data Subject under this Notice, you can contact the Association and the Data Protection Officer through the following channels:
Thai General Insurance Association
Contact Address: 25 Soi Sukhumvit 64/1, Sukhumvit Road, Phra Khanong Tai, Phra Khanong, Bangkok 10260
Phone: 0 2108 8399
Fax: 0 2108 8398
Website: https://tgia.sosimplestudio.co
Email: dpo@tgia.sosimplestudio.co
Data Protection Officer
Name: Mr. Suriya Nachin
Contact Address: 25 Soi Sukhumvit 64/1, Sukhumvit Road, Phra Khanong Tai, Phra Khanong,
Bangkok 10260
Phone: 0 2108 8399
Fax: 0 2108 8398
Website: https://tgia.sosimplestudio.co
Email: dpo@tgia.sosimplestudio.co