PERSONAL DATA PROTECTION POLICY
[draft AGMC 060726]

(Thailand PDPA-Compliant Template) 

1. Purpose 

Maitree Resort Development co., ltd ("Organization", "we", "our", or "us") is committed to protecting the privacy and security of personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). 

This Policy establishes rules governing the collection, use, disclosure, storage, transfer, retention, and disposal of personal data and ensures compliance with applicable legal and regulatory requirements. The policy also reflects internationally recognized data protection principles. 

2. Scope 

This Policy applies to: 

  • Directors, employees, officers, and contractors; 

  • Consultants and temporary workers; 

  • Service providers processing personal data on behalf of the Organization; 

  • All systems, databases, applications, websites, and business processes involving personal data. 

3. Definitions 

Personal Data 

Any information relating to an identified or identifiable individual, whether directly or indirectly identifiable. Examples include: 

  • Name 

  • Address 

  • Telephone number 

  • Email address 

  • Passport number 

  • National identification number 

  • Employee number 

  • Financial information 

  • Online identifiers 

  • Location information 

Data Subject 

The individual to whom Personal Data relates. 

Processing 

Any operation performed on Personal Data, including: 

  • Collection 

  • Recording 

  • Storage 

  • Use 

  • Analysis 

  • Sharing 

  • Transfer 

  • Deletion 

  • Destruction 

Data Controller 

A person or organization determining the purposes and means of processing personal data. 

Data Processor 

A person or organization processing personal data on behalf of a Data Controller. 

4. Data Protection Principles

The Organization shall ensure that Personal Data is: 

4.1 Lawfully, Fairly and Transparently Processed 
Personal Data shall only be processed where a lawful basis exists under the PDPA. 

4.2 Collected for Specified Purposes 
Personal Data shall only be collected for legitimate business purposes that have been clearly communicated to the Data Subject. 

4.3 Limited to What Is Necessary 
Only Personal Data that is adequate, relevant, and necessary shall be collected. 

4.4 Accurate 
Reasonable steps shall be taken to ensure Personal Data remains accurate and up to date. 

4.5 Retained Only as Long as Necessary 
Personal Data shall not be retained longer than required. 

4.6 Secure 
Appropriate technical and organizational safeguards shall be implemented. 

4.7 Accountable The Organization shall maintain records and demonstrate compliance with this Policy and the PDPA.  

5. Lawful Basis for Processing 

The Organization will process Personal Data only where at least one lawful basis exists: 

Consent
The Data Subject has provided valid consent. 

Contract 
Processing is necessary to perform a contract or enter into a contract. 

Legal Obligation 
Processing is necessary to comply with laws or regulatory requirements. 

Vital Interests 
Processing is necessary to protect life, health, or safety. 

Legitimate Interests 
Processing is necessary for legitimate business interests that do not override the rights and freedoms of the Data Subject. 

Public Interest
Processing is necessary for a public interest task or exercise of official authority.

6. Consent Requirements 

Where consent is relied upon: 

  • Consent shall be freely given. 

  • Consent shall be specific and informed. 

  • Consent requests shall be presented clearly and separately from other agreements. 

  • Records of consent shall be maintained. 

  • Data Subjects may withdraw consent at any time. 

  • Withdrawal of consent shall be as easy as giving consent. 

Where consent is withdrawn, processing based solely on that consent shall cease unless another lawful basis applies.  

7. Sensitive Personal Data

The Organization shall not process Sensitive Personal Data unless permitted under the PDPA. 

Sensitive Personal Data includes: 

  • Health information 

  • Biometric information 

  • Genetic data 

  • Criminal records 

  • Religious beliefs 

  • Political opinions 

  • Trade union membership 

  • Racial or ethnic origin 

  • Sexual orientation 

Explicit consent shall generally be obtained unless a PDPA exemption applies. Additional safeguards shall always be implemented.  

8. Privacy Notices

Before or at the time personal data is collected, the Organization shall provide a Privacy Notice describing: 

  • Identity of the Data Controller; 

  • Categories of personal data collected; 

  • Purpose of processing; 

  • Legal basis for processing; 

  • Retention period; 

  • Data recipients; 

  • International transfers; 

  • Data Subject rights; 

  • Contact details of the Organization or Data Protection Officer. 

Privacy Notices shall be clear, concise, and easily accessible. 

9. Access Controls and Security 

The Organization shall implement reasonable technical and organizational measures including: 

Physical Security 

  • Secure offices 

  • Locked cabinets 

  • Visitor controls 

Technical Security 

  • Encryption 

  • Firewalls 

  • Access controls 

  • Strong passwords 

  • Multi-factor authentication 

  • System monitoring 

Organizational Controls 

  • Staff training 

  • Confidentiality obligations 

  • Vendor due diligence 

  • Regular risk assessments 

Access to Personal Data shall be limited to authorized personnel with a legitimate business need.  

10. Sharing of Personal Data

Personal Data may be disclosed: 

  • To service providers and processors; 

  • To professional advisers; 

  • To regulatory authorities; 

  • To business partners where necessary; 

  • As required by law. 

All third parties receiving Personal Data shall be required to protect such data appropriately through contractual and security controls.  

11. International Transfers

Personal Data may be transferred outside Thailand only where: 

  • The receiving jurisdiction provides an adequate level of protection; or 

  • Appropriate safeguards are implemented; or 

  • A legal exception under the PDPA applies. 

The Organization shall maintain appropriate documentation relating to international transfers. 

12. Data Retention and Disposal 

Personal Data shall be retained only as long as: 

  • Necessary for the original purpose; 

  • Required by law; 

  • Needed for legal, regulatory, or contractual obligations. 

At the end of the retention period Personal Data shall be: 

  • Securely destroyed; 

  • Permanently deleted; or 

  • Irreversibly anonymized. 

13. Data Subject Rights 

Subject to applicable law, Data Subjects may exercise the following rights: 

Right of Access 
Request access to personal data. 

Right to Rectification 
Request corrections of inaccurate data. 

Right to Erasure 
Request deletion where legally applicable. 

Right to Restrict Processing 
Request limitation of processing activities. 

Right to Object 
Object to certain forms of processing. 

Right to Data Portability 
Receive data in a structured, commonly used format. 

Right to Withdraw Consent 
Withdraw previously granted consent at any time. 

Right to Lodge Complaints 
Submit complaints to Thailand's Personal Data Protection Committee (PDPC).  

14. Personal Data Breaches 

Any employee who becomes aware of: 

  • Unauthorized access, 

  • Loss, 

  • Theft, 

  • Disclosure, 

  • Alteration, or 

  • Destruction of Personal Data 

must report the incident immediately. 

The Organization shall: 

  • Investigate all incidents promptly; 

  • Contain and mitigate risks; 

  • Notify the PDPC where legally required; 

  • Notify affected Data Subjects where the breach presents a high risk to their rights and freedoms; 

  • Maintain breach records and lessons learned.  

15. Data Protection Impact Assessments

The Organization shall conduct a Data Protection Impact Assessment (DPIA) whenever processing activities present a high risk to Data Subjects, including: 

  • New technologies; 

  • Large-scale processing; 

  • Sensitive personal data; 

  • Systematic monitoring activities. 

Appropriate controls must be implemented before processing begins.  

16. Data Protection Officer 

Where required by the PDPA or deemed appropriate by management, the Organization shall appoint a Data Protection Officer ("DPO"). 

The DPO's responsibilities include: 

  • Monitoring compliance; 

  • Providing privacy guidance; 

  • Supporting data subject requests; 

  • Liaising with regulators; 

  • Advising on DPIAs and data breaches.  

17. Use of Artificial Intelligence Systems

Employees shall not enter Personal Data or confidential information into public or unapproved AI systems. 

Use of AI systems involving Personal Data must: 

  • Have an identified lawful basis; 

  • Implement appropriate safeguards; 

  • Comply with this Policy; 

  • Follow organizational approval procedures.  

18. Training and Awareness 

The Organization shall ensure that employees receive periodic training regarding: 

  • PDPA obligations; 

  • Information security; 

  • Incident reporting; 

  • Data subject rights; 

  • Responsible handling of Personal Data.  

19. Non-Compliance

Any violation of this Policy may result in: 

  • Disciplinary action; 

  • Contractual remedies; 

  • Regulatory reporting; 

  • Civil or criminal penalties under applicable law. 

20. Contact Details

Villa Zolitude Collection
Maitree Resort Development co., ltd

Email: rsvn@villazolitude.com
Telephone: (+66) 76 521 333
Address: 53/25 Moo 5, Soi Baan Nai Trok, Chaofah West Road
Chalong, Muang Phuket, Phuket 83130