Customer Privacy Policy

Customer Privacy Policy
Jubilee Enterprise Public Company Limited

Jubilee Enterprise Public Company Limited (“the Company”) values privacy and respects the rights to personal data of its customers. The Company guarantees to protect and process customer personal data correctly and in compliance with the personal data protection laws applicable to the Company. To demonstrate the Company’s commitment as a data controller, the Company intends to create and inform customers of this customer privacy policy (“Policy”), which defines the rights, conditions, and necessity for the Company to collect, process, and use your personal data as a customer who contacts the Company, purchases products, and/or uses services related to products under the brands “Jubilee Diamond” and “Forevermark” (“Customer”). The Company will only collect, gather, use, and disclose your personal data in accordance with this Policy.

Acceptance of Policy It is important that customers read this Policy to understand how the Company collects and uses your personal data. When a customer contacts, purchases products, and/or uses the Company’s services through various channels, including submitting their personal data to the Company, the Company will deem that the customer has agreed to and accepted this Policy. The Company would like to inform customers that all personal data processing specified in this Policy is important and necessary for the Company to perform its duties in selling products and/or providing services to customers. Therefore, if a customer does not agree to the processing of personal data under this Policy, it may affect the Company’s ability to perform such duties for you.

Scope of Policy Enforcement This Policy applies to direct contact and/or purchase of products from the Company, which may involve communication through various channels, both offline (e.g., purchasing products at a physical store or directly contacting the Company) and online (including communication through the Company's website or social media such as Facebook, Line Official Account, or other online channels). It does not apply to the processing of personal data by other third parties over whom the Company has no control, even if connected to the Company's services (including but not limited to the processing of personal data by other marketplace providers). For personal data processing by such third parties, customers must review the privacy policies of those third parties separately from this Policy.

Company's Right to Reserve The Company reserves the right to update this Policy periodically to comply with relevant laws and the Company's contact methods, sales, product delivery, and various services provided to customers. The Company will notify customers of such changes by publishing the updated Policy through the Company's communication channels. By continuing to communicate, purchase products, and/or use the Company's services after the Policy update, customers will be deemed to have agreed to the revised Policy.

Definitions

Under this Policy, (a) Personal Data means information that can identify a natural person, directly or indirectly, but does not include data of deceased persons, and (b) Data Subject means the person whose personal data is collected, used, or disclosed by the Company, including but not limited to individual customers, and authorized signatories or other related persons of corporate customers (e.g., authorized directors or relevant authorized representatives).

For the avoidance of doubt, in cases where a customer submits personal data of other related data subjects to the Company, upon receiving such personal data, the Company will deem that the customer has guaranteed the right to forward and disclose the data of all third-party data subjects to the Company for data processing under this Policy.

Sources of Personal Data Processed

The Company may receive personal data from customers and/or data subjects from two sources as follows:

1. Received directly from customers through various channels, including (a) inquiries through various channels the Company may have, such as telephone, social media / website; (b) accessing the Company's physical store services or visiting the Company's website; (c) customers participating in the Company's promotional activities through various channels; (d) customers filling out and submitting information, including any other forms for purchasing products and using the Company's various support services; or (e) automated collection by the Company's system that may collect, gather, and use personal data of customers who contact and use services through the Company's website.
2. Received from others, which may include social media, public media (that customers may use to link to the Company's services), business partners who may submit customer personal data to the Company (including but not limited to financial institutions or department stores that send customer data for gift redemption, etc.), external service providers hired by the Company in connection with the sale of products and services (including but not limited to marketplace providers), who are third parties, or other persons who may refer you to the Company, which the Company will inform customers about.

Data Processed

In coordinating, selling products, making payments, and delivering products between the Company and you, the Company needs to process customer personal data at each step as follows:

1. For customers purchasing products at Jubilee stores: facial images of customers that the Company may collect through a CCTV system installed within the store area, and collection of photographs from participating in Company activities that may be organized, both in terms of activity arrangement and live broadcasting or various video recordings within the store area. In the case of organizing activities or live broadcasting, if a customer does not wish to be photographed, they should avoid entering areas where live broadcasting is taking place or they can state their intention to refuse such photography.
2. For customers purchasing products through the Company's website: (1) Account creation information, which customers must create before ordering products, including email or Social Media Account (Facebook / Google / etc. to be linked), password, full name, phone number, date of birth, address, including user account information that will be created to link to individual customers again.

   (2) Product order information (e.g., order details, products purchased, and total amount from product purchases, etc.) including all transaction data that customers may conduct through the Company's website.

   (3) Customer technical data (Online Identifier), including location data, IP address, login information, browser type and version, time and location settings, connection and type of browser used to connect, operating system and platform, and other technologies on the device you use to access the Company's website.

   (4) Use of cookies (if customers consent). Customers can learn more about the Company's cookie policy at: https://www.jubileediamond.co.th/cookies-policy

3. Payment information and/or information for issuing tax invoices, which includes payment information for products, possibly including payment slips or credit card details collected via POS systems or payment service providers, as well as copies of credit cards attached to identification cards that customers may submit to Company employees for card processing to make payments, and other proof of payment. In the case of requesting a tax invoice, this includes identification documents and copies thereof, such as national ID cards or passports, etc.
4. Shipping information For product purchases where customers want products delivered, whether purchased through online/offline channels or other direct sales, this includes full name, shipping address, and contact information such as phone number or email, etc.
5. Other information that customers may provide to the Company in various forms that may be created between the Company and customers, including but not limited to product warranty forms, product exchange or return forms according to conditions that the Company may specify, or providing information for participation in promotional activities, surveys, competitions, prize draws, or any similar activities with the Company.
6. Other personal data that customers may consent to or submit to the Company for processing, such as contact information to receive support services or submit complaints through channels specified by the Company, etc.

Purpose and Retention Period of Personal Data Processing

The Company needs to collect, gather, use, and process customer personal data as specified above for the following purposes and durations:

1. For contractual obligations, the Company must process such personal data for (1) coordination, fulfillment of rights and duties the Company may have towards customers, including the execution of transactions for buying and selling products and/or providing services to customers, which may include verifying the identity of customers who purchase products and/or contact for services, verifying order accuracy, verifying payments, delivering products, and providing other support services to customers; (2) responding to inquiries, suggestions, and managing complaints that customers may submit to the Company; and (3) fulfilling other contracts between customers and the Company (e.g., sales contracts or terms of service specified on the Company's website) or to process customer requests, including considering qualifications and suitability for participation in activities that customers may join. For this purpose, the Company will retain customer personal data for as long as the Company has obligations to provide, deliver, or supply products to customers under sales contracts or other related service contracts, or for as long as customers have user accounts on the Company's website.
2. To comply with legal obligations that the Company must undertake, such as accounting and tax payments for the Company, especially when customers may request tax invoices from the Company or foreign customers require VAT refunds, for which the Company needs to collect customer data to prepare such documents for the duration stipulated by relevant laws.
3. To carry out operations for legitimate interests without unduly affecting the rights of the data subject, including (1) establishing and improving the business relationship the Company has with customers, which may include analyzing, investigating, managing, and resolving various issues related to the Company's services, inquiring about service satisfaction, preparing internal monitoring reports on the Company's services to customers, analyzing and managing overall organizational risk, training, or monitoring the service of the Company's employees, analyzing to improve the business relationship the Company has with customers, including analyzing and improving services, product design, and customer segmentation for the benefit of the Company's marketing and public relations planning; (2) using and analyzing purchasing and service behavior, preferences, and interests of customers in general and individually, for the benefit of planning, designing, and developing sales and services specifically for customers to meet their needs more accurately and appropriately; (3) using facial images of customers at the store, collected by a CCTV system, to maintain security within the store area and for the safety of customers using services within the store area; (4) using image data and other public relations data of data subjects participating in various marketing activities for the benefit of preparing the Company's public relations materials; and (5) collecting data for the benefit of protecting the Company's legitimate rights in the event of any complaints or disputes between the Company and customers. For this purpose, the Company guarantees to limit the use of personal data only as necessary for a reasonable period for the Company's business operations for the stated purposes, and will not take any action that unduly affects the rights of the data subject, and may store data in the form of anonymized statistics indefinitely.
4. In cases where consent is obtained from the customer, the Company will process customer personal data for the specific purposes for which consent was given, such as using data for public relations, informing about products, services, discounts, and other benefits of the Company through the Company's communication channels such as SMS, E-mail, Post, LINE application, and other electronic and online channels of the Company, which are relevant to the customer's interests, to the customer through various contact channels. The Company will process the customer's personal data for such purposes until the customer withdraws the consent they have given to the Company. This withdrawal of consent will not affect the collection, use, disclosure, or processing of personal data to which the customer has already consented.

Disclosure of Personal Data

In principle, the Company will not disclose or transfer customer personal data to third parties. However, in necessary cases, the Company may need to disclose and transfer customer personal data to the following persons:

1. Relevant external service providers, which may include external service providers who provide support to the Company in performing its duties and exercising its rights towards customers, such as payment service providers, IT system providers, shipping service providers, business partners who may jointly organize activities, and service providers involved in the Company's business operations, such as various consultants (including auditors or internal control system auditors), under the condition that the Company will disclose customer personal data only as necessary, within the framework of the personal data processing agreement that the Company will prepare and sign with such external service providers. In cases where the Company transfers and/or transmits personal data to service providers operating and processing personal data abroad, the Company will establish standards for entering into agreements and/or personal data processing contracts with service providers who will receive such personal data, ensuring that the personal data protection standards are acceptable and in accordance with relevant laws, to ensure that personal data is securely protected.
2. Various government agencies that the Company may be obligated to disclose customer personal data to in accordance with the law, according to the orders of relevant agencies, such as the Revenue Department, etc. The Company will only disclose and transfer data as necessary for such duties.
3. In cases where the customer provides consent, the Company may disclose personal data to specifically designated individuals.

Measures for Personal Data Security

The Company guarantees to implement appropriate security measures under relevant laws to prevent unauthorized or unlawful access, use, alteration, modification, or disclosure of personal data. The Company will review such measures periodically to ensure compliance and suitability with industry standards and changes in relevant laws.

Data Subject Rights

The Company respects the legal rights of customers as data subjects concerning your personal data under the Company's control. You may exercise the following rights within the framework of relevant laws: (1) Right to withdraw consent (2) Right to access and request a copy of personal data (3) Right to request correction of personal data to be accurate (4) Right to receive personal data, in cases where the Company makes such personal data in a format that can be read or used generally by automated tools or devices, including the right to request transmission or transfer of such data to another personal data controller (5) Right to object to the processing of personal data (6) Right to request erasure, destruction, or anonymization of personal data when such data is no longer necessary. However, in the case of exercising the right to erase or anonymize data, the Company may not be able to provide products or services to you or fulfill any contracts with you. Therefore, the Company reserves the right to consider refusing such requests if there is still a necessity to retain customer personal data (7) Right to request restriction of personal data use.

Customers can contact us to inquire about this Policy or to exercise their rights related to their personal data. The Company will inform you of the results of your request within a reasonable timeframe as stipulated by law.

By sending an email to DPO@jubileediamond.co.th or contacting the head office of Jubilee Enterprise Public Company Limited at No. 179, Bangkok City Tower, 10th Floor, South Sathon Road, Thung Maha Mek Subdistrict, Sathon District, Bangkok 10120.

Additionally, you can contact the company via Call Center at 02-625-1111, Monday-Friday, 09:00 – 18:00.

Last updated: 26 May 2022