Privacy Notice

Land and Houses Bank Public Company Limited (“LH Bank”, “we” or “our”) values privacy and strives to protect your personal data or personal data relating to individuals connected to your business (collectively referred to as “Personal Data”) based on the law of Thailand.

This Privacy Notice explains: -
1. What kind of Personal Data do we collect? This includes what you tell us about yourself or the individuals connected to your business (collectively referred to as “you”, “your” or “yourself”), what we learn by having you as a customer, and the choice you have given us about what marketing messages/information you want us to send to you.
2. How do we use your Personal Data?
3. Who do we disclose your Personal Data to?
4. What are the choices we offer, including how to access and update your Personal Data? What are your privacy rights and how the law protects you?

1. What kind of Personal Data do we collect?
We collect many kinds of your Personal Data, depending on various circumstances and nature of products, services and/or transactions that you have requested.

We may collect Personal Data about you from a variety of sources as follows: -
1. When you apply for our products and/or services
2. When you talk to us on phone or in branch, including recorded calls, posts, e-mails, notes and other means
3. When you use our websites or mobile device applications. This includes cookies and other internet tracking software to collect Personal Data. Please refer to our Cookies Policy for more information
4. Insurance claims or other documents
5. Financial reviews and interviews
6. Customer surveys
7. When you take part in our sale promotion activities
8. When you manifestly publish your Personal Data, including via social media (e.g., we may collect your Personal Data from your social media profile(s), to the extent that you choose to make your profile publicly visible)
9. When we receive your Personal Data from third parties, e.g., your employer, our customers, credit reference agencies, law enforcement authorities, etc.
10. When you purchase any of our products or services from third parties

We sometimes collect Personal Data from additional online and offline sources including commercially available third-party sources such as credit reporting agencies (including the National Credit Bureau). We may combine this information with the Personal Data we have collected about you under this Privacy Notice.
 
In some instances, we may engage third parties outside Land and Houses financial Business group to collect Personal Data about your online activities when you visit our online sources. We may also use Personal Data collected across websites outside the group for the purpose of serving you advertisements related to your browsing behaviour. While we engage in this practice, we will provide an appropriate notice and choice so that you can opt-out of such processing.

In some cases, we may collect personal data from other organizations or parent companies/major shareholders or subsidiaries or people related to the Bank to manage risks according to the duties that the bank as a financial institution should perform, such as inspecting transactions to prevent financial crimes or inspecting transactions with those related to the same business group, to prevent conflicts of interest. We will use the data as necessary for the stated purpose of collection.
 
Categories of Personal Data about you that we collect, subject to the applicable law,are as follows: -
Personal details: given name(s), last name, gender, date of birth, marital status, personal identification number, passport number, other government issued number(s), tax identification number, nationality, image of passport, driving license, signatures, authentication data (e.g., passwords, answer in resetting the password, PINs, facial and voice recognition data), photographs, visual images and CCTV footages

Family details: names and contact details of family members and dependents
Contact details: address, telephone number, email address and social media profile details
Education history: details of your education and qualifications
Financial details: billing address, bank account numbers, credit card numbers, cardholder or accountholder name and details, instruction records, transaction details and counterparty details
Electronic data: IP addresses, cookies, activity logs, online identifiers, unique device identifiers and geolocation data

2. How do we use your Personal Data?
 We may collect, use and disclose your Personal Data only if we have proper reasons and it is lawful to do so. This includes sharing it outside LH Bank.

We will rely on one or more of the following lawful grounds when processing your Personal Data:
1. When it is to fulfil a contract we have with you (Fulfilment of contract);
2. When it is our legal duty (Our legal duty);
3. When it is in our legitimate interest (Our legitimate interest);
4. When you consent to it (Your consent);

The purposes and legal bases for which we may process your Personal Data, subject to the applicable law are:










In cases where the bank processes personal data of minors, incompetent person or quasi- incompetent person, we will ask for consent from parents, guardians, or guardians (as the case may be) except in cases where the law allows it to be carried out without consent.

When we rely on legitimate interest as a reason for processing Personal Data, we will consider whether our interest is more important than your fundamental rights and it must be concluded that such interest overrides your fundamental rights.

3. Who do we disclose Personal Data to?
   We may share your Personal Data with others where it is lawful to do so, including where we or they: -

1. need to fulfill requirement under contract, or products and/or services you have requested, e.g., to fulfil a payment request, etc.
2. have legal duties to do so, e.g., to assist with detecting and preventing fraud, tax evasion and financial crime, etc.
3. need to report in connection with regulatory reporting, litigation or asserting or defending legal rights and interests.
4. have legitimate business reasons to do so, e.g., to manage risk, verify identity, enable another company to provide you with the services you have requested or assess your suitability for the products and/or services.
5. ask for your consent to share it, and you have agreed.

We may share your Personal Data for the aforementioned purposes with others, including: -

1. Companies within the group, business partners and any sub-contractors,
   agents or service providers who work for us or provide services to us or to the companies within the group, including their employees, directors and officers
2. any trustees, beneficiaries, administrators or executors
3. people who give guarantee or securities for any amount you owe us
4. people you make payment to and receive payment from
5. your intermediaries, correspondent and agent bank, clearing houses, clearing or settlement systems, market counterparties and any company you carry out
   investment services through us
6. other financial institutions, lenders and holders of securities over any properties or assets you have mortgaged with us, tax authorities, trade
   associations, credit reference agencies, payment service providers and debt recovery agents
7. any fund managers who provide asset management services to you and any brokers who introduce you to us or deal with us for you
8. any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition or takeover, including any transfer or potential transfer of any of our rights or duties under our agreement with you
9. law enforcement, government, courts, dispute resolution bodies, our regulators,  auditors and any parties appointed or requested by our regulators to carry out investigations or audits of our activities
10. other parties involved in any disputes, including disputed transactions
11. fraud prevention agencies who will also use data to detect and prevent fraud and other financial crimes and to verify your identity
12. anyone who provides instructions or operates any of your accounts, products or services on your behalf, e.g., Power of Attorney, solicitors, intermediaries, etc.
13. anybody else that we have been instructed to share your Personal Data with by you

There may be instances which we may share non-personally identifiable information about you to third parties, such as advertising identifiers or one-way coding (cryptographic hash) of a common account identifier, such as a contact number or   e-mail address, to enable targeted advertising.

Except as described in this Privacy Notice, we will not use Personal Data for any purposes other than the purposes described to you in this Privacy Notice. Should we intend to collect, use or transfer your data outside the scope of this Privacy Notice, we will notify you and obtain your consent prior to the collection, use and disclosure, unless the law allows us to do so without your consent. You will also be given the opportunity to consent or to decline such collection, use and/or transfer of your Personal Data.
 
We will continue to adhere to this Privacy Notice with respect to the information we have in our possession relating to prospective, existing and former customers and investors.

Cross-border Transfer of Personal Data
Your personal data may be transferred to the parent company/affiliated company of the financial business group located abroad, such as Taiwan, or transferred to other companies located abroad and processing abroad, such as transferring personal data to be stored on a server/Cloud abroad, etc.

We will check to make sure that such countries have measures to protect personal data at a level comparable to Thailand or at an appropriate level, and that such transferring is lawful. We may need to transfer Personal Data in this way to carry out our contract with you, fulfill legal obligations, protect public interests and/or for our legitimate interests. In some countries, the law might compel us to share certain personal data, e.g., with tax authorities or National Bank. Even in these cases, we will only share Personal Data with people who have the right to access it.

4. Retention of Personal Data
We retain your Personal Data for as long as it is necessary to carry out the purposes for which it was collected, e.g., for business and legal purposes, or compliance with applicable laws.

We may keep your Personal Data for up to 10 years after you stop being our customer to ensure that any contractual dispute that may arise can be processed within the time frame. However, in the event of regulatory or technical reasons, we may keep your Personal Data for more than 10 years. If we do not need to retain your Personal Data for longer than it is legally necessary, we will destroy, delete or anonymize it.

When you receive products and/or services from third party, e.g., insurance company, who has been introduced to you by us, such third party may keep your Personal Data in accordance with additional terms and conditions related to products and services.

5. Accuracy of Your Personal Data
We need your help to ensure that your Personal Data is current, complete, and accurate. Please inform us of any changes to your Personal Data by contacting our representative channels at: -



We will occasionally request updates from you to ensure Personal Data we use to fulfill the purposes of collection, use and/or disclosure are current, accurate and complete.

6. What are your privacy rights and how the law protects you?

1. Right to withdraw: This enables you to withdraw your consent to our processing of your Personal Data. However, we may continue to process your Personal Data if we have another legitimate reason to do so.
2. Right to Access: This enables you to receive a copy of Personal Data we hold about you and to check if we are lawfully processing it.
3. Right to Correction: This enables you to have any incomplete or inaccurate information we hold about you corrected.
4. Right to Deletion: This enables you to ask us to delete or remove, destroy or anonymize your Personal Data where there is no good reason for us to continue processing it. You also have the right to ask us to delete or remove, destroy or anonymize your Personal Data where you have exercised your right to object to processing (see below). However, we may continue to process your Personal Data if we have another legal basis to do so.
5. Right to Object the Collection, Use, or Disclosure: This enables you to object to the processing of your Personal Data where we are relying on legitimate interest and there is something about your particular situation which makes you want to object to the processing on this ground. You also have the right to object where we are processing your Personal Data for direct marketing purposes and profiling activities (the automated processing of your information to help us evaluate your attributes, for example, your personal preferences and your interests) relating to direct marketing.
6.  Right to Suspense: This enables you to ask us to suspend the processing of your Personal Data, for example, if you want us to establish its accuracy or the reason for processing it.
7. Right to Portability: This enables you to request the transfer of your Personal Data to another party.
8. Right to Lodge a Complaint: This enables you to file complaints with related government authorities, including but not limited to, the Thailand Personal Data Protection Committee.

Handling of Complaints
In the event that you wish to make complaints about how we process your Personal Data, please contact us and we will try to consider your request as soon as possible. This does not prejudice your right to file complaints with government authorities that have data protection authority.

7. Security of Your Personal Data
Information is our asset and therefore we place great importance on ensuring the security of your Personal Data. We regularly review and implement up-to-date physical, technical and organizational security measures when processing your Personal Data. We have internal policies and controls in place to ensure your Personal Data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties. Our employees are trained to handle Personal Data securely and with utmost respect. Failing to do so, they may be subject to a disciplinary action.

8. Your Responsibilities
You are responsible for making sure Personal Data you have given us or provided on your behalf, is accurate and up to date, and you must tell us as soon as possible if there are any updates.

You have responsibilities under your contract to provide us with Personal Data. You may also have to provide us with Personal Data in order to exercise your statutory rights. Failing to provide the Personal Data may mean that you are unable to exercise your statutory rights.

Certain Personal Data, such as contact details and payment details, must be provided to us in order to enable us to enter into contract with you. If you do not provide such Personal Data, this will hinder our ability to administer the rights and obligations arising as a result of contract efficiently.

9. Revision of Our Privacy Notice
We keep our Privacy Notice under a regular review and thus Privacy Notice may be subject to changes. The date of the revision can be found at the bottom of every page.

10. Contact Us
If you have any questions in regard to the protection of your Personal Data or if you wish to exercise your rights, please contact: -