LEGAL · Customers and counterparties

Privacy Notice for Customers and Counterparties

Last updated 2 Jun 2026

§ 01About this notice

Ruk-Com Co., Ltd. and the external providers engaged under our data processing agreements (together, “we”) recognise your privacy rights and our responsibilities in collecting, using and disclosing (“processing”) your personal data as a customer or counterparty of the company. We therefore publish this privacy notice to explain how your personal data is processed under the Personal Data Protection Act B.E. 2562.

§ 02Definitions

“Personal data” means information about a person that can identify them directly or indirectly, excluding data about deceased persons.
“Sensitive personal data” means the data defined in section 26 of the PDPA — for example racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data with a similar impact on the data subject.
“PDPA” means the Personal Data Protection Act B.E. 2562, together with related subordinate legislation and amendments from time to time.
“The Committee” means the Personal Data Protection Committee.

§ 03Personal data we collect

The personal data we may collect includes:

Name, address, phone number, email and a copy of your ID card.
Company certificates and powers of attorney.
Bank account number and payment information.
Technical service data such as IP address, login information (user accounts), computer traffic data (logs), domain names and service configuration needed to deliver Cloud/Hosting services and maintain security.
Any other information the company requests from you or your legal entity in order to enter into a contract, provide services or carry out related activities.

If you provide us with another person’s personal data, you confirm that you have shown them this notice and obtained their consent to disclose their data to us.

§ 04How we collect your data

We generally collect personal data directly from you, except in some cases where we may collect it from the person who referred you, from public sources, business sources or commercial sources.

§ 05Purposes and legal bases for processing

No.	Purpose	Legal basis
1	To enter into a contract with you and perform the rights and duties under it	Contract
2	To verify and confirm your identity	Contract
3	To support contract formation and to verify details during the contract term	Contract
4	To support accounting disbursements	Contract / legal obligation
5	To comply with laws, announcements, regulations and orders of relevant state agencies, such as the Office of the Personal Data Protection Committee	Contract / legal obligation
6	To establish, exercise, dispute or act on the company’s legal claims	Contract / legitimate interest
7	To contact you and conduct business throughout our relationship	Contract
8	To register and change the recorded ownership of services	Contract
9	To sign you up for other services offered by Ruk-Com’s business partners	Contract
10	To promote and improve internal processes for customers	Consent / contract
11	To provide Cloud, Hosting, domain and related services, including installation, care, maintenance and troubleshooting	Contract
12	To maintain the security of systems and data — for example monitoring and preventing cyber threats and retaining computer traffic data (logs) as required by law	Legal obligation / legitimate interest
13	To analyse and improve service quality, which may use artificial intelligence (AI) to analyse usage or support service delivery, such as automated question answering. The company does not rely on automated decision-making alone where it significantly affects you, without human oversight.	Consent / legitimate interest

§ 06Who may receive your personal data

We may disclose and/or transfer your personal data to the following parties, who may be located inside or outside Thailand:

Data processors engaged under the company’s data processing agreements.
Internal and external advisers or experts, such as legal counsel and auditors.
Service providers or their agents (including sub-providers) — for example payment services, technology services, cloud and data centre providers in Thailand and abroad, data analytics services, marketing services and other services related to the company’s business.
Law enforcement agencies, state agencies, regulators or dispute resolution bodies, as required by law or under relevant agreements.
Parties entering or proposing to enter into a transaction with the company, such as a sale or proposed sale of the business (if any).
Any other party to whom you have given explicit consent.

Note: for third-party personal data (such as your own customers or users) that you store or process on the company’s services, the company acts as a “data processor”. The associated rights and duties are set out in the company’s PDPA Notice and Data Processing Agreement (DPA).

§ 07Cross-border transfers of personal data

Your personal data may be stored or processed in data centres in Thailand and abroad (for example Singapore), depending on the region of the service you choose, or may be sent to the parties described above. Cross-border transfers follow the data protection conditions required by the PDPA.

§ 08Retention of personal data

We keep your personal data for as long as necessary to achieve the purposes above, and for no more than 15 years from the date your relationship or last contact with us ends, unless the law permits longer retention. At the end of that period we delete, destroy or anonymise the data.

§ 09Your rights regarding personal data

You have the following rights in relation to your personal data:

Withdraw or request changes to the scope of the consent you gave us.
Ask whether we hold your personal data, request access or a copy, and ask how we process it.
Request correction of your personal data.
Request deletion or destruction of your personal data in certain cases.
Request restriction of the processing of your personal data in certain cases.
Request the transfer of your personal data in certain cases.
Request temporary suspension of the processing of your personal data in certain cases.

We act on requests within 30 days of receiving the request with complete documents. We reserve the right not to comply to the extent the law permits, and may charge a reasonable fee. You also have the right to complain to the expert committee under the procedure in the PDPA.

§ 10Changes to this notice

The company reserves the right to amend, add to, change or improve this notice to the extent the law permits. Where a change is material, the company notifies you and/or requests your consent where the law requires it.

§ 11Contact channels

If you have questions about this notice, or want to exercise your rights over your personal data, please contact us at:

Data Protection Unit, Ruk-Com Co., Ltd., Vanit Place Ari (Building A), Unit 2703, 27th Floor, 304 Phaholyothin Rd., Samsen Nai, Phaya Thai, Bangkok 10400, Thailand. Email: [email protected]