Privacy Policy

1. Introduction & Commitment

Optimo (Thailand) Co., Ltd. ("the Company," "we," "us," or "our"), having its registered head office at 2 Soi Krungthep Kritha 19, Thap Chang Sub-district, Saphan Sung District, Bangkok 10250, Thailand, recognizes the critical importance of privacy and personal data protection.

This Privacy Policy outlines our standards and practices regarding the collection, use, processing, storage, disclosure, and safeguarding of personal data in strict compliance with the Personal Data Protection Act B.E. 2562 (2019) of the Kingdom of Thailand ("PDPA") and its subordinate ministerial regulations.

2. Scope of Policy

This policy applies to personal data collected across all business divisions and touchpoints operated by the Company, including but not limited to:

• Corporate website interactions (optimothai.com) and inquiry submissions.
• Consumer engagements across our beauty and cosmeceutical brands (AquaPlus Series, Vie Cosmetics, BYS Cosmetics).
• Enterprise digital loyalty, LINE CRM solutions, and POS integrations (Funcrowd).
• Commercial automotive detailing and chemical distribution (Optimax Auto, FW1, Purewax).
• Commercial real estate leasing and co-investment communications (Optimo Properties).
• Corporate procurement, bespoke merchandise, and global sourcing inquiries (Optimo Premiums).
• Prospective business partners, authorized dealers, franchisees, and employment applicants.

3. Personal Data Collected

Depending on the nature of your interaction with the Company, we may collect the following categories of personal data:

• Identity Information: Name, surname, national identity card number or passport number (where legally mandated for commercial contracts or tax compliance), job title, and employer/organization.
• Contact Information: Business or residential address, corporate or personal email address, telephone numbers, and LINE User ID.
• Commercial & Transactional Data: Order history, billing invoices, payment confirmation slips, delivery records, warranty registration, and tax identification numbers.
• Digital & Technical Identifiers: IP address, device metadata, browser type, operating system, session cookies, referral URLs, and browsing timestamps.
• Recruitment Data: Educational background, employment history, professional references, curriculum vitae, and relevant professional credentials.

4. Lawful Bases and Purposes for Processing

We process your personal data strictly under lawful bases recognized by the PDPA, specifically:

• Contractual Performance (Section 24(3)): To fulfill contractual commitments, process purchase orders, deliver procured goods, execute commercial leases, and facilitate business partnership agreements.
• Consent (Section 19): Where you have provided clear, affirmative consent for direct marketing communications, targeted newsletters, or optional customer satisfaction surveys.
• Legitimate Interests (Section 24(5)): To analyze business performance, optimize digital infrastructure, prevent fraudulent transactions, and maintain physical security at our Bangkok Headquarters and regional branches.
• Legal Compliance (Section 24(6)): To fulfill mandatory statutory duties under Thai revenue, commercial, tax, and labor legislation.

5. Retention Period of Personal Data

Personal data is retained only for the duration necessary to satisfy the objectives set forth in this policy, or as mandated by applicable statutory limitation periods. Commercial accounting records and tax-related documentation are retained for a minimum of 10 years in compliance with the Thai Revenue Code and the Accounting Act B.E. 2543. Upon expiration of the designated retention schedule, data is irreversibly erased or anonymized through secure cryptographic shredding procedures.

6. Disclosure to Third Parties & Cross-Border Transfers

The Company will not sell, rent, or lease personal data to external third parties. We may disclose personal data to authorized third-party service providers solely under strict non-disclosure and data processing agreements:

• Logistics and domestic delivery carriers for fulfillment of corporate merchandise and consumer orders.
• Cloud infrastructure providers, enterprise data centers, and CRM software platforms operating under international ISO/IEC 27001 data security accreditations.
• Financial institutions and electronic payment gateways for secure transactional processing.
• Legal advisors, chartered accountants, and external regulatory auditors.

Where cross-border transfers occur (e.g., communications with our international affiliate offices across 500+ locations worldwide), the Company ensures that recipient jurisdictions maintain personal data protection standards equivalent to or exceeding the requirements of the Thailand PDPA.

7. Your Legal Rights as a Data Subject

Under Chapter 3 of the PDPA, you are entitled to exercise the following statutory rights free of charge:

• Right to Access: You may request access to and obtain copies of your personal data maintained in our systems.
• Right to Rectification: You may request immediate correction of incomplete, inaccurate, or outdated personal data.
• Right to Erasure / Deletion: You may request the destruction or anonymization of your data where lawful processing grounds no longer apply.
• Right to Restrict Processing: You may request the suspension of data usage in specific statutory circumstances.
• Right to Data Portability: You may request that your structured machine-readable data be transmitted directly to another data controller where technically feasible.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is predicated upon consent, you may withdraw your consent at any time without retroactive impact on prior lawful processing.

8. Data Security Architecture

The Company implements stringent administrative, physical, and technical safeguards designed to protect personal data against accidental loss, unauthorized access, illicit disclosure, or alteration. These measures encompass multi-factor authentication (MFA), role-based access control (RBAC), end-to-end Transport Layer Security (TLS 1.3) encryption in transit, and AES-256 encryption at rest.

9. Data Protection Officer (DPO) Contact Details

For inquiries regarding this Privacy Policy, or to submit a formal Data Subject Rights Request, please direct your correspondence to our Data Protection Office:

You also maintain the statutory right to file a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you consider our data processing practices to be in violation of the PDPA.