INFORMATION ON PERSONAL DATA PROCESSING
We, Nextgen Mobility Hub Company Limited, will collect information related to personal data in
providing our services and we have taken the liberty of informing you in this document of the
manner and extent of processing personal data and of the extent of your rights, as data subjects,
in relation to the processing of your personal data according to Personal Data Protection Act B.E.
2562 (hereinafter referred to as “PDPA”) on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data. This Policy applies to all
personal data that collected in our services regardless of the country or region where our services
are being provided and explains what kind of personal data we will collect, and which purposes
will we use and share such data including how can you manage your personal data.
1. WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?
The controller of your personal data is the company Nextgen Mobility Hub Company Limited,
58/18 Mae Luan Rd., Talat Nuea Subdistrict, Mueang Phuket District, Phuket 83000,
Registration No. 0835569009691, +66816636555, [email protected] (hereinafter also referred
to as “Nextgen Mobility Hub”).
2. WHICH PERSONAL DATA DO WE PROCESS, TO WHAT EXTENT AND FOR
WHICH PURPOSES?
We only process those personal data, and to such an extent, that enable us to be able to provide
you with our services, adhere to our statutory obligations and protect our legitimate interest. We
collect the personal data of our clients, including former clients, who have given consent to use
continuing to contact them with the offer of our services.
We may process your personal data for the following purposes:
(a) Processing for the provision of performance according to a contract on the temporary
use of a vehicle that you have entered into with us
We process the following categories of your personal data for the purposes of performing the
contract we have together:
(1) identification data, such as first name, surname, date of birth, Personal Number or other
personal identification number;
(2) contact details, including mobile telephone number and e-mail addresses;
(3) data arising from your proof of identity and driving license, such as card number, the date on
which it was issued, the term of validity, an indication of the body that issued it, information
about permanent residence (place of residence) and place of actual residence, scope of the
driving license and information about the existence (absence) of medical contra-indications
relating to the use of a vehicle, and a photograph;
(4) payment data, including the number of your payment card and the identification numbers
required for executing a payment;
1(5) other personal data and documents arising within the bounds of the administration and
performance of our contract with each other, including any penalties, insurance benefit, etc.
We primarily process these data for the purpose of verifying your identity and your authorisation
to drive a motor vehicle and for the purpose of ensuring communication to concern the
performance of our contract with each other. We process your payment data for the purposes of
ensuring payment for the services provided.
The provision and processing of your personal data is required to be able to enter a contract and
subsequently perform that contract according to Article 24 Para. 1 (3) PDPA.
(b) Processing for the statutory obligations of Nextgen Mobility Hub
Some processing of your personal data is imposed on us by the law. For example, accounting and
tax documents with which we bill you for the services provided might also contain certain
personal data (for example, your first name and surname, the type of service provided). We only
store such documents for the purposes of fulfilling the obligations laid down by the relevant legal
regulations to concern accounting and tax, for the length of time dictated by these regulations.
Such processing is required in order that Nextgen Mobility Hub may fulfil its legal obligations
according to Article 24 Para. 1 (6) PDPA.
(c) Processing in our legitimate interest
We process some personal data in our legitimate interest in the defense of claims and for the
purpose of protecting our property. The data involved is primarily your identification data,
geolocation data of the vehicle and data to concern the administration of the contract, including
documents from administrative bodies and insurance companies or other personal data required
for the purposes specified above. Such processing is in our legitimate interest according to
Article 24 Para. 1 (5) PDPA.
(d) Marketing
We also process your personal data for the purposes of our marketing campaigns, for example for
sending out individual offers of the services which we provide, if you have not expressed your
disagreement to such personal data processing. We may process your personal data for marketing
purposes even following the expiration of our contract with each other if you have given us your
express consent to such processing.
Processing the personal data of our clients for the purposes of direct marketing is in our
legitimate interest according to Article 24 Para. 1 (5) PDPA; however, you may refuse their
sending at any time using our contact e-mail address specified below or in the way described in
the marketing email.
Processing in relation to our former customers is based on consent, according to Article 24 Para.
1 PDPA.
(e) Development and improvement of services and contents
We also process your personal data for the purpose of development and improvement of our
services and contents. This is for providing better services and contents to users toward the
future, for example, we will create the statistics and models related to the use of our Services, we
2may collect the history of use, the frequency of tab using in the app to improve the screen design,
etc.
3. DO WE CARRY OUT THE AUTOMATED PROCESSING OF YOUR PERSONAL
DATA?
Subject to the restriction of Automated individual decision-making, the verification of your age
and length of your driving practice will be a subject to automatic decision-making process. It is
necessary for the purposes of conclusion of our contract. The age and driving practice check will
be carried out automatically, and provided that at least one of the parameters show up to be
unsatisfying your request for registration will be refused. If this is the case, then you shall have
the right to apply for a verification of the result by the human. We will proceed to human
verification in case you approach us by raising the objection against the automatic processing.
4. WHO PROCESSES YOUR PERSONAL DATA?
Your personal data is processed by Nextgen Mobility Hub or by selected processors, who also
provide sufficient and credible guarantees of the safeguarding of your personal data protection
(for example, providers of IT services and services in the area of security, accountants, providers
of analytical services and other suppliers).
Your personal data may, under certain conditions, be provided to governmental authorities
(Courts, police, Revenue Department, Bank of Thailand, etc., within the bounds of them
executing their legal powers) or we may provide them directly to other subjects to the extent laid
down by special law. Personal data to the extent laid down by law may also be transferred to
insurance companies.
With respect to your using our services in the Kingdom of Thailand, your personal data may be
transferred for processing within the Kingdom of Thailand and other countries where companies
from the Nextgen Mobility Hub group are present. In case of your Personal data are transferred
to countries outside the Kingdom of Thailand, it will be executed strictly in accordance with the
legal regulations and only when sufficient protection of the Personal Data is ensured, among
others, by 1) PDPA, 2) appropriate internal legally binding regulations, 3) approved code of
conduct along with legally binding and enforceable obligations by the data controller and
processor within the Kingdom of Thailand, 4) based on specific situation exempt, or 5) standard
contract clause in accordance with PDPA.
5. HOW DO WE ENSURE THE SECURITY AND PREVENTION OF UNAUTHORISED
USE OF YOUR PERSONAL DATA?
We take the measures required to ensure secure storage of information in electronic format and
on paper and to prevent unauthorized access, changes or disclosure of information. Our
information security is supported by a number of security standards, processes and procedures.
We store information in areas with restricted access or in electronic databases which require
login data and passwords. We demand that the providers of our data storage sites and other
processors comply with the relevant standards of industrial security. All partners, employees and
providers of services who have access to confidential information are subject to the obligation of
confidentiality.
6. HOW LONG DO WE STORE YOUR PERSONAL DATA?
3We only store your personal data for the length of time required to achieve the set purpose. We
process your personal data for the provision of our services for the duration of your contract and
thereafter for the duration absolutely required by legal regulations for the duration of our
legitimate interest. If we have consent, we process your personal data only until such consent is
withdrawn, and for a maximum of 5 years from the last update of your user account.
7. WHAT RIGHTS DO YOU HA VE IN CONNECTION WITH THE PROCESSING OF
YOUR PERSONAL DATA?
The right to information on the processing of and access to your personal data
You have the right to receive from us the confirmation of whether personal data which concerns
you are or are not processed and if so, you have the right to access such personal data and to
further information about processing. You also have the right to provision of copies of processed
personal data.
The right of rectification
You have the right to demand that we rectify inaccurate personal data that concern you or
supplement incomplete personal data, without undue delay. Please inform us of all changes to
concern your personal data at the address provided below.
The right to restriction of processing
As the data subject, you have the right to demand us to restrict the processing of your personal
data if:
o you contest the accuracy of the personal data which we process about you, for the period
of time required for us to verify the accuracy of your personal data;
o the processing of your personal data is unlawful and you oppose the erasure of the
personal data and request the restriction of its use instead;
o the processing of your personal data is no longer required by us, but you request us for
the establishment, exercise or defense of legal claims; or
o you have lodged a complaint against processing on the ground of decision making purely
on the basis of automated process, until it is verified whether our legitimate interests
prevail over your justified grounds.
If processing has been restricted based on any of the grounds specified above, the concerned
personal data may only be processed (save storage) with your consent or on the ground of the
establishment, exercise or defense of legal claims, protecting another natural person or legal
person or a significant public interest. We are obliged to inform you of ending the restriction of
processing your personal data in advance.
The right to object
If you believe that the processing of your personal data is proceeding contrary to the protection
of your privacy or contrary to legal regulations, you have the right to lodge an objection to such
personal data processing. In the same way you may lodge an objection to automated decision
making.
4The right to data portability
You have the right to obtain your personal data in a structured, commonly used and
machine-readable format and have the right to transmit those data to another controller such that
personal data are transferred directly by Nextgen Mobility Hub to another controller, if this is
technically feasible.
The right to erasure
You have the right to demand that we erase without delay personal data that concern you, if at
least one of the following conditions is satisfied:
the personal data are no longer necessary for the purposes for which they were collected or
otherwise processed; you withdraw consent to the processing of your personal data and no
further legal grounds for their processing exist on our part; you object to the processing of your
personal data and there are no overriding legitimate grounds for their processing on our part;
personal data have been processed unlawfully; personal data must be erased in order to fulfill our
legal obligations; personal data have been collected in connection with the offer of services of
the information society.
The conditions specified above do not apply if the processing of personal data is required:
to exercise the right of freedom of expression and information; for compliance with a legal
obligation which requires processing by PDPA to which we are subject or for the performance of
a task carried out in the public interest or in the exercise of official authority vested in us; for
reasons of public interest in the area of public health; for archiving purposes in the public
interest, scientific or historical research purposes or statistical purposes in so far as the right of
erase is likely to render impossible or seriously impair the achievement of the objectives of that
processing; or for the establishment, exercise or defense of legal claims.
Right to withdraw consent
If we process personal data based on your consent, you may withdraw such consent at any time
and for any reasons, free of charge. However, the withdrawal of such consent shall not affect the
lawfulness of processing personal data occurred before the withdrawal. Such withdrawal may be
in writing, by sending an e-mail or letter to the contact address specified below, without any
consequences for our contractual relationships with each other, either current or future.
The right to lodge an initiative or complaint
If you have doubts as to adherence to the obligations associated with personal data processing,
you may contact us or Personal Data Protection Committee Office (Tel. 02 142 1033 or 02 141
6993), having its principal office at No. 120, Moo. 3, 7th floor, the Government Complex
Commemorating His Majesty, the King’s 80th birthday anniversary (Building B), Chaengwattana
RD, Thungsonghong Sub-district, Lak-si District, Bangkok 10210.
We provide you with all communications and statements without charge and as soon as possible
(not later, however, not exceeding one month).
58. HOW CAN YOU CONTACT US?
You may exercise your rights, make inquiries, or submit remarks to us by telephone Nextgen
Mobility Hub +66816636555, by e-mail [email protected], or in writing, to the mailing address
of Nextgen Mobility Hub: 58/18 Mae Luan Rd., Talat Nuea Subdistrict, Mueang Phuket District,
Phuket 83000.
Privacy Policy during the use of mobile application Gekkon and the web site
www.gekkon.me
We thank you for your interest in Gekkon mobile app and web site www.gekkon.me (jointly
referred to as the “app”). We are committed to protecting your privacy as an app user. This
document explains how we handle personal data with regard to the app. "Personal data" means
all information that relates to an identified or identifiable natural person.
1. Who is responsible for processing your personal data?
Nextgen Mobility Hub Company Limited, Registration No. 0835569009691, +66816636555,
58/18 Mae Luan Rd., Talat Nuea Subdistrict, Mueang Phuket District, Phuket 83000.
2. For what purposes do we process your personal data and what legal permission do we
have for this?
We process personal data pursuant to the applicable data protection laws. Data is processed for
the following purposes: for the fulfillment of the contract with you for the use of the app
(provision of the app and its functionalities) in each case to the extent necessary for this. When
you register to the app, we will collect your name, email and email address to match the request
to your user account. We process the information and data provided by you to respond to your
request through our customer service. We delete the personal data as soon as further processing
for the purpose of contract fulfillment is no longer necessary or you may withdraw such consent
at any time and for any reasons. Further storage or processing shall only be carried out as
envisaged herein below. If you have opted into the processing of personal data for other purposes
this data processing is conducted on the basis of your consent. Consent is always voluntary, and
you can opt out at any time. You can also declare your opt out by sending an email to
[email protected] and specify the extent of the opt out. We collect, process and use your personal
data in order to provide the app and its functionalities only to the extent necessary or as far as
you have consented to an additional use. In particular we use data that you enter and, if you
release them, data that is existent on the mobile device or is being generated through the use of
device functionalities (location data). The use of the app is possible without access to this data.
The access may be deactivated and reactivated at any time by/at Settings Android: > Apps >
Gekkon > App permissions > Location Off; iOS: > Privacy > Location Services > Gekkon > Off.
However, if the access of the app to the data is deactivated, this might lead to limitations on
functionalities. Opting out has no effect on the lawfulness of data processing based on your
consent until your opt out. Nor does it have an effect on further processing of this data on another
legal basis, such as to fulfill legal obligations. If required, we process your personal data beyond
contractual fulfillment in order to pursue legitimate interests of the publisher or of third parties.
Legitimate interests include maintaining the functionality and security of our IT systems. This
app generates a permanent reference number and transmits this to us. This reference number
allows us to determine which end device uses your user account. We will only use this data for
the purpose of identifying possible misuse of your account. This enables us to inform you via
text message if another end device logs in to your account for the first time. We generally delete
this personal data once further processing or archiving is no longer needed to protect the
6respective legitimate interest. Further storage or processing shall only be carried out as envisaged
herein below. Our company is subject to legal obligations and requirements, such as retention
obligations under commercial and tax laws. Therefore, we also process personal data of the users
if needed to comply with legal obligations. We disclose personal data of a user only if there is a
legal obligation to law enforcement and criminal prosecution authorities.
3. What content do we send to and store on your device?
The app uses cookies and similar technologies such as HTML5 storage (hereinafter referred to
collectively as "Cookies") for optimal design of the app. This enables easier navigation and a
high level of user-friendliness in the app. Cookies are small files that are stored on your device.
These can be used to determine whether your device has already communicated with us. Only
the cookie on your device is identified. Personal data can be stored in cookies if you have
provided your consent or this is absolutely required for technical reasons to fulfill the contract,
e.g. to enable secure login.
We use the following cookies in the app:
●
Remember Me Token to allow authenticated calls
●
Session ID for the Gekkon backend uses.
The app may use third party code and libraries that use “cookies” to collect information and
improve their services as well as to ascertain information about your location, for marketing and
analytical purposes and for redirection to other sites, as the case may be. You have the option to
either accept or refuse such when “cookies” are being sent to your device. If you choose to refuse
our “cookies”, you may not be able to use some portions of this Service. The use of the
“cookies” setting is part of your Internet browser. Most browsers automatically accept cookies as
the default setting. You may set your web browser in such a way as to ban or block the storing of
“cookies” on your device, including the “cookies” of third parties. You can also block or permit
the storage of “cookies” for certain websites only. You can delete the “cookies” that are already
stored on your device at any time and make the corresponding changes to the settings of the
relevant Internet browser.
The data which we obtain in this way may be disclosed to other processors that provide sufficient
and credible guarantees of safeguarding the protection of your Personal Information, in particular
to the operators of other services and platforms. Collected “cookies” are mainly processed via:
Google Play Services
AdMob
Firebase Analytics
Fabric
Crashlytics
Matomo
Appsflyer
4. Which services do we use to evaluate usage data and how can they be deactivated?
Use of AppsFlyer Technology
We use the services of AppsFlyer Ltd., 14 Maskit St., Herzliya, Israel ("AppsFlyer",
www.appsflyer.com) to learn more about how users reach and use our app. When using these
services, certain information about the devices used by the users, their online behavior and the
page content accessed is collected, processed and used. This applies in particular to information
such as: unique identifiers such as IP address, user agent, IDFA (Identifier For Advertisers),
7Android ID (in Android devices), Google Advertiser ID technical data regarding the device's
operating system, device attributes and settings, applications, advertising optout signals,
downloads, impressions, clicks and installations of mobile applications, in-app behavior, device
motion parameters and carrier. AppsFlyer uses these data on our behalf to evaluate and analyze
the performance of our marketing measures and channels, to find out how users respond to
specific campaigns, how they use the app and interact with it. The data described above is not
used to individualize individual users or to assign them to a specific person. Furthermore, the
data are used to detect and prevent cases of so-called "mobile fraud", i.e. manipulative and
fraudulent actions relating to our marketing measures. On the basis of the collected data which
are aggregated in the course of the process, AppsFlyer can identify for us, if certain actions
relating to our app (e.g. download or installation) have been manipulated. This also serves our
business interests as we have to consider such mobile fraud actions in the invoicing process with
our cooperating partners (advertising networks/ partner websites which display our
advertisements). The processing of these data is therefore based on the so-called balancing of
interests clause in PDPA and our legitimate interest as described above.
iOS device
If the app offers services from service providers and other third parties, especially Apple Maps",
Apple Inc. 1 Infinite Loop, Cupertino, CA 95014, USA, we transfer the users' personal data to
them. This occurs only as necessary for the availability and use of the app and its functions, to
pursue legitimate interests of the publisher or third parties, or if you have previously opted in to
the transfer. We have carefully selected the service providers and monitor them regularly,
particularly with regard to the diligent handling of and security for the personal data accessible to
them. We require that all providers agree to confidentiality and compliance with the legal
obligations. Data recipients in third-party countries: We transfer users' personal data to recipients
in countries outside the Kingdom of Thailand as follows: USA Apple Maps", Apple Inc. 1
Infinite Loop, Cupertino, CA 95014, USA.
Android device
If the app offers services from service providers and other third parties, especially Google
Maps", Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, we transfer
the users' personal data to them. This occurs only as necessary for the availability and use of the
app and its functions, to pursue legitimate interests of the publisher or third parties, or if you
have previously opted in to the transfer. We have carefully selected the service providers and
monitor them regularly, particularly with regard to the diligent handling of and security for the
personal data accessible to them. We require that all providers agree to confidentiality and
compliance with the legal obligations. Data recipients in third-party countries: We transfer users'
personal data to recipients in countries outside the Kingdom of Thailand as follows: USA Google
Maps", Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
5. How long does Gekkon stores your data?
Unless you request the deletion of your Account, in principle, we store and process your personal
data only as long as needed for the respective purpose. Moreover, data is stored and processed
only if required for another purpose, such as to comply with legal requirements (such as retention
obligations under tax or commercial laws). In this case, we limit further data processing to this
purpose and the legal basis of further processing as follows;
•
•
Data processing for contract fulfillment: Article 24 Para. 1 (3) PDPA;
Data processing based on your consent: Article 24 Para. 1 (5) PDPA;
8•
•
•
Data processing for compliance with legal requirements: Article 24 Para. 1 (6) PDPA;
Storage by providers in third-party countries “Appropriate safeguards” as defined by
Article 28 PDPA when using service providers as set forth in the section “Recipients of
personal data” are provided by standard data protection clauses as approved; or
adopted by the Personal Data Protection Committee, binding corporate rules, or similar
instruments.
Once your account is deleted, we will retain your personal data for a given period of time and
process your personal data properly according to Personal Data Protection applicable laws and
our internal rules for inquiry reply, disputes resolution or fee collection, detection and deterring
fraudulent use of, or abuse of, our services.
6. What is your choices regarding your personal data
As a data subject affected by data processing, you have the following rights, information (Article
30 and 31 PDPA); rectification (Article 35 and 36 PDPA); data erasure (Article 32 PDPA);
restriction of processing (Article 34 PDPA); data portability (Article 30 and 31 PDPA); Right to
object for reasons relating to your particular situation, you have the right to file an objection at
any time to processing of your personal data based on the performance of a task carried out in the
public interest or in the exercise of official authority vest in the Nextgen Mobility Hub according
to Article 24 Para 1. (4) PDPA or data processing based on a consideration of interests according
to Article 24 Para. 1 (5) PDPA. If you file an objection, we will continue to process your
personal data only if we can document mandatory, legitimate reasons that outweigh your
interests, rights, and freedoms, or if processing is for the assertion, exercise or defense of legal
claims. To exercise your right of objection send us an email to [email protected].
7. Complaints
If you feel that the processing of your personal data is in breach of legal requirements, you have
the right to file a complaint with the responsible data protection supervisory authority according
to Article 73 PDPA.
8. More information on personal data processed
While using Gekkon service, we may require you to provide us with your (1) last name, first
name, other names or patronymic (if specified in the ID-card), (2) date, month and year of birth,
(3) place of birth, (4) individual identification number if applicable, (5) the issuing authority, the
date of issue and validity period, the series and number of the ID-card (or its substitute), (6)
information about the registration address at the place of residence, (7) driving license data
(issuing authority, issuance date and validity period, series and number of the driving license,
category driving license, (8) contact details, including but not limited to mobile phone number,
e-mail address, (9) information on the presence (absence) of medical contra-indications to the
use of the vehicle, (10) photography, (11) data on the place of work and position held, (12)
geolocation data (navigational data), (13) advertising ID for the purposes of identification of the
user´s devise at starting the rent, un/locking the vehicle, and (14) any other personal data related
or which may be created in connection with the conclusion and performance of a contract to
which you are party. The information that we request will be retained by us and used as
described in this Privacy Policy.
99. More information on personal data processing purposes
9.1 Fraud prevention and identification check
Gekkon checks your personal customer data against sanction lists and compliance lists within the
framework of legal requirements and within its own legitimate interests. For fraud prevention
purposes, Gekkon carries out an identity check which is done by our service provider Sum and
Substance Limited, incorporated and registered in England with company number 09688671,
whose registered office is at 80 Wood Ln Central Working White City London W12 0BZ, as part
of a manual reconciliation process. If you decide to validate your driving license and ID card via
our Gekkon App, the images you have taken of your driving license, ID card and the portrait
picture you have taken yourself will be collected and processed for the purposes of validating
your driving license and ID card. The driving license data and ID card are read out electronically
from the pictures of your driving license you have taken, and the pictures of your face are
compared with the driving license/ID card pictures (face match). These images are stored as
permanent proof of driving license/ID card control. These image files are verified by our service
provider Sum and Substance Limited, incorporated and registered in England with company
number 09688671, whose registered office is at 80 Wood Ln Central Working White City
London W12 0BZ, as part of a manual reconciliation process. Gekkon processes the position
data (start and end position) of its vehicles in order to analyze the use of its fleet. Such data is
also used to develop a statistical model which is able to predict a possible future demand for
Gekkon vehicles. For such purposes only data without a direct link to a natural person is being
processed. To the extent data processing is based on the balance of interest test and thus
legitimate interests, more information about the balance of interest test is available upon request.
9.2 Rent
To start and terminate the individual lease of our Gekkon vehicles, it is necessary that we record
the starting position and final position, the distance driven, the quantity of fuel used and the time
and date of lease. Gekkon processes your personal data provided in course of the registration for
our services in order to set up your customer account and to contact you for contract related
purposes. This also includes the validation of a driving license with one of our validation
partners. In this context, we collect your driving license data to ensure that you have the
appropriate driving license. If you contact our customer service by email or telephone, Gekkon
collects the information and data (including personal data) provided by you in order to be able to
process your request. A further collection and processing of your personal data, such as a call
recording for improving our customer service, will only take place if you have given your
consent. If you use a vehicle of another Gekkon entity in another country, Gekkon transfers your
personal data provided by you during the registration and validation to this Gekkon entity to
enable the rental. In the event of an accident with the Gekkon, we process the personal data
collected in connection with the accident in order to settle damage claims with the other party
involved in the accident and/or with our and/or the other party's insurance company. The
aforementioned processing of personal data may also be based on the legitimate interests of
Gekkon. We process personal data from you on the basis of lawfulness of processing under
Article 24 PDPA, on the basis of the legitimate interests of Gekkon with regard to the processing.
Gekkon also processes your personal data collected during the individual lease process in order
to identify and rectify possible errors and malfunctions in the rental process and in the overall
operation of services. Gekkon may transfer your personal customer data (name, address) to third
parties, if this is necessary to enable the respective third parties to establish contact with the
respective customer and to directly raise claims towards the customer in the case of not
10obviously unfounded claims of such third parties asserted against Gekkon, which arise from
parking violations in private space. Gekkon may transfer your personal customer data to
governmental authorities, courts, external advisors, and similar third parties that are public
bodies or authorized third parties (e.g. mobility platform providers) as required or permitted by
applicable law e.g. if the processing is necessary for the purposes of the legitimate interests
pursued by Gekkon. This may for example be the case, if you have committed an administrative
offense during an individual lease.
9.3 Marketing
To provide you with information and advice from Gekkon about our products and services and to
provide you with particular offers (e.g. on events or special offers) in writing, in a verbal
communication, or communication via electronic mail (email, SMS, messenger, push messages).
If you have consented, your personal data may also be collected and processed to apply
analytical methods including profiling to measure and evaluate your interests. Such execution is
operated for the purpose of further individualizing the contact between Gekkon and you. The
processing may include that online usage behavior and social media usage is being collected and
processed. We process your personal data on the basis of your consent with information of
cooperation partners of Gekkon about their products and services. Creation of user profiles to
improve our services and adapt our products even better to your needs. Gekkon links data about
the use of our products and services with your profile and can thus inform you according to your
interests. This also includes, for example, that your use of our website or our app is recorded and
evaluated together with your personal customer data. Conducting personalized market research
and opinion surveys for quality assurance purposes and improving our own services and
products. In order to improve our own services and products, personal customer data resulting
from the use of Gekkon vehicles that have been consented from the customer. It also includes
position and transaction data that arise during the use of mobility services. If you use
corresponding mobility or networked vehicle services, position and movement data (in particular
GPS data) are generated. We can process the data transmitted to us from the vehicle for this
purpose to evaluate, for example, in which area and when you use mobility offers or track your
vehicle position. This way we can point out suitable promotions or show you available mobility
offers in your area when you park your vehicle. Such collecting and processing this data, enables
Gekkon to better analyze our products and to ultimately improve us for other our customers.
10. Are you obligated to provide your personal data and what happens if you do not provide
it?
The provision of the personal data is necessary for the performance of a contract to which you
are party or in order to take steps at your request prior to entering into a contract is mandatory,
otherwise we would not be able perform such a contract or in a position to take steps at your
request. The provision of other personal data is voluntary. In the event that you do not wish to
provide your personal data as part of your consent, you can still use our services. However, we
may not be able to offer you the services and products requiring your consent. Furthermore,
Gekkon may transfer your personal data to the recipients and/or categories of recipients
described below.
11. More information of third parties involvement
11Gekkon uses external IT service providers who provide us the server infrastructure, IT
maintenance tasks or extensive IT solutions (such as cloud services) and software solutions on
behalf of Gekkon. Gekkon uses external service providers for invoice archiving purposes.
Governmental authorities, courts, external advisors, and similar third parties that are public
bodies or other authorized third parties, provided that the facts described above are present (e.g.
parking offence or administrative offences or a legal obligation to provide information or account
suspension due to unauthorized use). For the organization of marketing activities and
promotions, personal customer data are partly transferred to service providers used for these
purposes. Gekkon uses external service providers for market research purposes. Gekkon transfers
your personal data to shipping companies if processing is required for communication by post. In
the event of an accident with an Gekkon vehicle, customer data is transferred to insurance
companies and if applicable, to the other party involved in the accident. Gekkon uses external
service providers to ensure the safety and cleanliness of the vehicles and to find any lost objects.
For this purpose, vehicle related and in some cases driver related data are transferred to these
service providers. Gekkon uses external service providers to provide our customer service. For
this purpose, personal customer data is transferred to these service providers. For the validation
of driving licenses at Gekkon validation partners, Gekkon uses these partners as service
providers. For this purpose, personal customer data is transferred to these service providers.
Gekkon processes your data in countries where the Kingdom of Thailand has established an
adequate level of data protection. In the following cases, processing takes place in countries
where the Kingdom of Thailand has not established an adequate level of data protection. We
have ensured an adequate level of data protection by providing for appropriate safeguards, in
particular, by entering into agreements with the recipients of personal.
12. More information on the term of storage of the data
Gekkon stores your personal data for as long as this personal data is necessary for the fulfilment
of the purpose the data has been collected for. In addition, Gekkon stores personal data as
required by legal regulations and stores until the expiry of applicable limitation periods in order
to be able to assert any existing legal claims.
13. Please take note that you have certain rights in relation to our processing of your
personal data under legal regulations:
•
•
•
•
•
Information about and access to your personal data – you have the right to obtain
confirmation explanation as to whether your personal data are being processed by us and,
where that is the case, to access and receive information about your personal data.
Rectification of personal data – you have the right to have your personal data rectified if
they are inaccurate our outdated.
Erasure of personal data – you have the right, in certain situations, to have your personal
data erased.
Object to processing – you have the right to object to processing where your personal
data are being processed for direct marketing purposes.
Data portability– you have the right to have your personal data transferred by us to
another organization, if you have provided us with this data and we are processing it
based on your consent.
In the event of you have given Gekkon consent to data processing, you can withdraw this
consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the
12processing prior to the consent withdrawal. You also have the right to lodge a complaint with the
competent data protection supervisory authority, where you believe that the collection, use, and
disclosure of your personal data is unlawful or non-compliant with the PDPA. To exercise your
rights as mentioned above, please send us an email to [email protected]. If you have doubts as to
whether we are adhering to the obligations associated with personal data processing, please
contact us or Personal Data Protection Committee Office (Tel. 02 142 1033 or 02 141 6993),
having its principal office at No. 120, Moo. 3, 7th floor, the Government Complex
Commemorating His Majesty, the King’s 80th birthday anniversary (Building B), Chaengwattana
RD, Thungsonghong Sub-district, Lak-si District, Bangkok 10210.
14. Changes to the Privacy Policy
This Privacy Policy may require an update from time to time – e.g. due to the implementation of
new technologies or the introduction of new services. We reserve the right to change or
supplement this Privacy Policy at any time. We will publish the changes on www.gekkon.me and
inform you via email accordingly.
13