Privacy Policy

Privacy Policy

INFORMATION ON PERSONAL DATA PROCESSING

We, Gekkon Company Limited, will collect information related to personal data in providing our services and we have taken the liberty of informing you in this document of the manner and extent of processing personal data and of the extent of your rights, as data subjects, in relation to the processing of your personal data according to Personal Data Protection Act B.E. 2562 (hereinafter referred to as “PDPA”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This Policy applies to all personal data that collected in our services regardless of the country or region where our services are being provided and explains what kind of personal data we will collect, and which purposes will we use and share such data including how can you manage your personal data.

1. WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?

The controller of your personal data is the company Gekkon Company Limited, 10/19 Moo 10, Chalong Sub-District, Muang Phuket District, Phuket, Registration No. 0835566004922, +66804465190, [email protected] (hereinafter also referred to as “Gekkon Company Limited”).

2. WHICH PERSONAL DATA DO WE PROCESS, TO WHAT EXTENT AND FOR WHICH PURPOSES?

We only process those personal data, and to such an extent, that enable us to be able to provide you with our services, adhere to our statutory obligations and protect our legitimate interest. We collect the personal data of our clients, including former clients, who have given consent to use continuing to contact them with the offer of our services.

We may process your personal data for the following purposes:

(a)Processing for the provision of performance according to a contract on the temporary use of a vehicle that you have entered into with us

We process the following categories of your personal data for the purposes of performing the contract we have together:

identification data, such as first name, surname, date of birth, Personal Number or other personal identification number;
contact details, including mobile telephone number and e-mail addresses;
data arising from your proof of identity and driving license, such as card number, the date on which it was issued, the term of validity, an indication of the body that issued it, information about permanent residence (place of residence) and place of actual residence, scope of the driving license and information about the existence (absence) of medical contra-indications relating to the use of a vehicle, and a photograph;
payment data, including the number of your payment card and the identification numbers required for executing a payment;
other personal data and documents arising within the bounds of the administration and performance of our contract with each other, including any penalties, insurance benefit, etc.

We primarily process these data for the purpose of verifying your identity and your authorisation to drive a motor vehicle and for the purpose of ensuring communication to concern the performance of our contract with each other. We process your payment data for the purposes of ensuring payment for the services provided.

The provision and processing of your personal data is required to be able to enter a contract and subsequently perform that contract according to Article 24 Para. 1 (3) PDPA.

(b) Processing for the statutory obligations of Gekkon Company Limited
Some processing of your personal data is imposed on us by the law. For example, accounting and tax documents with which we bill you for the services provided might also contain certain personal data (for example, your first name and surname, the type of service provided). We only store such documents for the purposes of fulfilling the obligations laid down by the relevant legal regulations to concern accounting and tax, for the length of time dictated by these regulations. Such processing is required in order that Gekkon Company Limited may fulfil its legal obligations according to Article 24 Para. 1 (6) PDPA.

(c) Processing in our legitimate interest
We process some personal data in our legitimate interest in the defense of claims and for the purpose of protecting our property. The data involved is primarily your identification data, geolocation data of the vehicle and data to concern the administration of the contract, including documents from administrative bodies and insurance companies or other personal data required for the purposes specified above. Such processing is in our legitimate interest according to Article 24 Para. 1 (5) PDPA.

(d) Marketing
We also process your personal data for the purposes of our marketing campaigns, for example for sending out individual offers of the services which we provide, if you have not expressed your disagreement to such personal data processing. We may process your personal data for marketing purposes even following the expiration of our contract with each other if you have given us your express consent to such processing.

Processing the personal data of our clients for the purposes of direct marketing is in our legitimate interest according to Article 24 Para. 1 (5) PDPA; however, you may refuse their sending at any time using our contact e-mail address specified below or in the way described in the marketing email.

Processing in relation to our former customers is based on consent, according to Article 24 Para. 1 PDPA.

(e) Development and improvement of services and contents
We also process your personal data for the purpose of development and improvement of our services and contents. This is for providing better services and contents to users toward the future, for example, we will create the statistics and models related to the use of our Services, we may collect the history of use, the frequency of tab using in the app to improve the screen design, etc.

3. DO WE CARRY OUT THE AUTOMATED PROCESSING OF YOUR PERSONAL DATA?

Subject to the restriction of Automated individual decision-making, the verification of your age and length of your driving practice will be a subject to automatic decision-making process. It is necessary for the purposes of conclusion of our contract. The age and driving practice check will be carried out automatically, and provided that at least one of the parameters show up to be unsatisfying your request for registration will be refused. If this is the case, then you shall have the right to apply for a verification of the result by the human. We will proceed to human verification in case you approach us by raising the objection against the automatic processing.

4. WHO PROCESSES YOUR PERSONAL DATA?

Your personal data is processed by Gekkon Company Limited or by selected processors, who also provide sufficient and credible guarantees of the safeguarding of your personal data protection (for example, providers of IT services and services in the area of security, accountants, providers of analytical services and other suppliers).

Your personal data may, under certain conditions, be provided to governmental authorities (Courts, police, Revenue Department, Bank of Thailand, etc., within the bounds of them executing their legal powers) or we may provide them directly to other subjects to the extent laid down by special law. Personal data to the extent laid down by law may also be transferred to insurance companies.

With respect to your using our services in the Kingdom of Thailand, your personal data may be transferred for processing within the Kingdom of Thailand and other countries where companies from the Gekkon Company Limited group are present. In case of your Personal data are transferred to countries outside the Kingdom of Thailand, it will be executed strictly in accordance with the legal regulations and only when sufficient protection of the Personal Data is ensured, among others, by 1) PDPA, 2) appropriate internal legally binding regulations, 3) approved code of conduct along with legally binding and enforceable obligations by the data controller and processor within the Kingdom of Thailand, 4) based on specific situation exempt, or 5) standard contract clause in accordance with PDPA.

5. HOW DO WE ENSURE THE SECURITY AND PREVENTION OF UNAUTHORISED USE OF YOUR PERSONAL DATA?

We take the measures required to ensure secure storage of information in electronic format and on paper and to prevent unauthorized access, changes or disclosure of information. Our information security is supported by a number of security standards, processes and procedures. We store information in areas with restricted access or in electronic databases which require login data and passwords. We demand that the providers of our data storage sites and other processors comply with the relevant standards of industrial security. All partners, employees and providers of services who have access to confidential information are subject to the obligation of confidentiality.

6. HOW LONG DO WE STORE YOUR PERSONAL DATA?

We only store your personal data for the length of time required to achieve the set purpose. We process your personal data for the provision of our services for the duration of your contract and thereafter for the duration absolutely required by legal regulations for the duration of our legitimate interest. If we have consent, we process your personal data only until such consent is withdrawn, and for a maximum of 5 years from the last update of your user account.

7. WHAT RIGHTS DO YOU HAVE IN CONNECTION WITH THE PROCESSING OF YOUR PERSONAL DATA?

The right to information on the processing of and access to your personal data
You have the right to receive from us the confirmation of whether personal data which concerns you are or are not processed and if so, you have the right to access such personal data and to further information about processing. You also have the right to provision of copies of processed personal data.

The right of rectification
You have the right to demand that we rectify inaccurate personal data that concern you or supplement incomplete personal data, without undue delay. Please inform us of all changes to concern your personal data at the address provided below.

The right to restriction of processing
As the data subject, you have the right to demand us to restrict the processing of your personal data if:

you contest the accuracy of the personal data which we process about you, for the period of time required for us to verify the accuracy of your personal data;
the processing of your personal data is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
the processing of your personal data is no longer required by us, but you request us for the establishment, exercise or defense of legal claims; or
you have lodged a complaint against processing on the ground of decision making purely on the basis of automated process, until it is verified whether our legitimate interests prevail over your justified grounds.

If processing has been restricted based on any of the grounds specified above, the concerned personal data may only be processed (save storage) with your consent or on the ground of the establishment, exercise or defense of legal claims, protecting another natural person or legal person or a significant public interest. We are obliged to inform you of ending the restriction of processing your personal data in advance.

The right to object
If you believe that the processing of your personal data is proceeding contrary to the protection of your privacy or contrary to legal regulations, you have the right to lodge an objection to such personal data processing. In the same way you may lodge an objection to automated decision making.

The right to data portability
You have the right to obtain your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller such that personal data are transferred directly by Gekkon Company Limited to another controller, if this is technically feasible.

The right to erasure
You have the right to demand that we erase without delay personal data that concern you, if at least one of the following conditions is satisfied:

the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; you withdraw consent to the processing of your personal data and no further legal grounds for their processing exist on our part; you object to the processing of your personal data and there are no overriding legitimate grounds for their processing on our part; personal data have been processed unlawfully; personal data must be erased in order to fulfill our legal obligations; personal data have been collected in connection with the offer of services of the information society.

The conditions specified above do not apply if the processing of personal data is required:
to exercise the right of freedom of expression and information; for compliance with a legal obligation which requires processing by PDPA to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right of erase is likely to render impossible or seriously impair the achievement of the objectives of that processing; or for the establishment, exercise or defense of legal claims.

Right to withdraw consent
If we process personal data based on your consent, you may withdraw such consent at any time and for any reasons, free of charge. However, the withdrawal of such consent shall not affect the lawfulness of processing personal data occurred before the withdrawal. Such withdrawal may be in writing, by sending an e-mail or letter to the contact address specified below, without any consequences for our contractual relationships with each other, either current or future.

The right to lodge an initiative or complaint
If you have doubts as to adherence to the obligations associated with personal data processing, you may contact us or Personal Data Protection Committee Office (Tel. 02 142 1033 or 02 141 6993), having its principal office at No. 120, Moo. 3, 7th floor, the Government Complex Commemorating His Majesty, the King’s 80th birthday anniversary (Building B), Chaengwattana RD, Thungsonghong Sub-district, Lak-si District, Bangkok 10210.

We provide you with all communications and statements without charge and as soon as possible (not later, however, not exceeding one month).

8. HOW CAN YOU CONTACT US?

You may exercise your rights, make inquiries, or submit remarks to us by telephone Gekkon Company Limited, by e-mail [email protected], or in writing, to the mailing address of Gekkon Company Limited: 10/19 Moo 10, Chalong Sub-District, Muang Phuket District, Phuket, 83130.

Privacy Policy during the use of mobile application Gekkon and the web site
www.gekkon.me

We thank you for your interest in Gekkon app and web site www.gekkon.me (jointly referred to as the “app”). We are committed to protecting your privacy as an app user. This document explains how we handle personal data with regard to the app. "Personal data" means all information that relates to an identified or identifiable natural person.

1. Who is responsible for processing your personal data?

Gekkon Company Limited, 10/19 Moo 10, Chalong Sub-District, Muang Phuket District, Phuket 83130, Registration No. 0835566004922, +66804465190, [email protected]

2. For what purposes do we process your personal data and what legal permission do we have for this?

We process personal data pursuant to the applicable data protection laws. Data is processed for the following purposes: for the fulfillment of the contract with you for the use of the app (provision of the app and its functionalities) in each case to the extent necessary for this. When you register to the app, we will collect your name, email and email address to match the request to your user account. We process the information and data provided by you to respond to your request through our customer service. We delete the personal data as soon as further processing for the purpose of contract fulfillment is no longer necessary or you may withdraw such consent at any time and for any reasons. Further storage or processing shall only be carried out as envisaged herein below. If you have opted into the processing of personal data for other purposes this data processing is conducted on the basis of your consent. Consent is always voluntary, and you can opt out at any time. You can also declare your optout by sending an email to [email protected] and specify the extent of the optout. We collect, process and use your personal data in order to provide the app and its functionalities only to the extent necessary or as far as you have consented to an additional use. In particular we use data that you enter and, if you release them, data that is existent on the mobile device or is being generated through the use of device functionalities (location data). The use of the app is possible without access to this data. The access may be deactivated and reactivated at any time by/at Settings Android: > Apps > Gekkon > App permissions > Location Off; iOS: > Privacy > Location Services > Gekkon > Off. However, if the access of the app to the data is deactivated, this might lead to limitations on functionalities. Opting out has no effect on the lawfulness of data processing based on your consent until your optout. Nor does it have an effect on further processing of this data on another legal basis, such as to fulfill legal obligations. If required, we process your personal data beyond contractual fulfillment in order to pursue legitimate interests of the publisher or of third parties. Legitimate interests include maintaining the functionality and security of our IT systems. This app generates a permanent reference number and transmits this to us. This reference number allows us to determine which end device uses your user account. We will only use this data for the purpose of identifying possible misuse of your account. This enables us to inform you via text message if another end device logs in to your account for the first time. We generally delete this personal data once further processing or archiving is no longer needed to protect the respective legitimate interest. Further storage or processing shall only be carried out as envisaged herein below. Our company is subject to legal obligations and requirements, such as retention obligations under commercial and tax laws. Therefore, we also process personal data of the users if needed to comply with legal obligations. We disclose personal data of a user only if there is a legal obligation to law enforcement and criminal prosecution authorities.

3. What content do we send to and store on your device?

The app uses cookies and similar technologies such as HTML5 storage (hereinafter referred to collectively as "Cookies") for optimal design of the app. This enables easier navigation and a high level of user-friendliness in the app. Cookies are small files that are stored on your device. These can be used to determine whether your device has already communicated with us. Only the cookie on your device is identified. Personal data can be stored in cookies if you have provided your consent or this is absolutely required for technical reasons to fulfill the contract, e.g. to enable secure login.
We use the following cookies in the app:

Remember Me Token to allow authenticated calls
Session ID for the Gekkon backend uses.

The app may use third party code and libraries that use “cookies” to collect information and improve their services as well as to ascertain information about your location, for marketing and analytical purposes and for redirection to other sites, as the case may be. You have the option to either accept or refuse such when “cookies” are being sent to your device. If you choose to refuse our “cookies”, you may not be able to use some portions of this Service. The use of the “cookies” setting is part of your Internet browser. Most browsers automatically accept cookies as the default setting. You may set your web browser in such a way as to ban or block the storing of “cookies” on your device, including the “cookies” of third parties. You can also block or permit the storage of “cookies” for certain websites only. You can delete the “cookies” that are already stored on your device at any time and make the corresponding changes to the settings of the relevant Internet browser.

The data which we obtain in this way may be disclosed to other processors that provide sufficient and credible guarantees of safeguarding the protection of your Personal Information, in particular to the operators of other services and platforms. Collected “cookies” are mainly processed via:

AdMob
Google Play Services
Firebase Analytics Fabric
Crashlytics Matomo Appsflyer

4. Which services do we use to evaluate usage data and how can they be deactivated?

Use of AppsFlyer Technology
We use the services of AppsFlyer Ltd., 14 Maskit St., Herzliya, Israel ("AppsFlyer", www.appsflyer.com) to learn more about how users reach and use our app. When using these services, certain information about the devices used by the users, their online behavior and the page content accessed is collected, processed and used. This applies in particular to information such as: unique identifiers such as IP address, user agent, IDFA (Identifier For Advertisers), Android ID (in Android devices), Google Advertiser ID technical data regarding the device's operating system, device attributes and settings, applications, advertising optout signals, downloads, impressions, clicks and installations of mobile applications, in-app behavior, device motion parameters and carrier. AppsFlyer uses these data on our behalf to evaluate and analyze the performance of our marketing measures and channels, to find out how users respond to specific campaigns, how they use the app and interact with it. The data described above is not used to individualize individual users or to assign them to a specific person. Furthermore, the data are used to detect and prevent cases of so-called "mobile fraud", i.e. manipulative and fraudulent actions relating to our marketing measures. On the basis of the collected data which are aggregated in the course of the process, AppsFlyer can identify for us, if certain actions relating to our app (e.g. download or installation) have been manipulated. This also serves our business interests as we have to consider such mobile fraud actions in the invoicing process with our cooperating partners (advertising networks/ partner websites which display our advertisements). The processing of these data is therefore based on the so-called balancing of interests clause in PDPA and our legitimate interest as described above.

iOS device
If the app offers services from service providers and other third parties, especially Apple Maps", Apple Inc. 1 Infinite Loop, Cupertino, CA 95014, USA, we transfer the users' personal data to them. This occurs only as necessary for the availability and use of the app and its functions, to pursue legitimate interests of the publisher or third parties, or if you have previously opted in to the transfer. We have carefully selected the service providers and monitor them regularly, particularly with regard to the diligent handling of and security for the personal data accessible to them. We require that all providers agree to confidentiality and compliance with the legal obligations. Data recipients in third-party countries: We transfer users' personal data to recipients in countries outside the Kingdom of Thailand as follows: USA Apple Maps", Apple Inc. 1 Infinite Loop, Cupertino, CA 95014, USA.

Android device
If the app offers services from service providers and other third parties, especially Google Maps", Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, we transfer the users' personal data to them. This occurs only as necessary for the availability and use of the app and its functions, to pursue legitimate interests of the publisher or third parties, or if you have previously opted in to the transfer. We have carefully selected the service providers and monitor them regularly, particularly with regard to the diligent handling of and security for the personal data accessible to them. We require that all providers agree to confidentiality and compliance with the legal obligations. Data recipients in third-party countries: We transfer users' personal data to recipients in countries outside the Kingdom of Thailand as follows: USA Google Maps", Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

5. How long does Gekkon stores your data?

Unless you request the deletion of your Account, in principle, we store and process your personal data only as long as needed for the respective purpose. Moreover, data is stored and processed only if required for another purpose, such as to comply with legal requirements (such as retention obligations under tax or commercial laws). In this case, we limit further data processing to this purpose and the legal basis of further processing as follows:

Data processing for contract fulfillment: Article 24 Para. 1 (3) PDPA;
Data processing based on your consent: Article 24 Para. 1 (5) PDPA;
Data processing for compliance with legal requirements: Article 24 Para. 1 (6) PDPA;
Storage by providers in third-party countries “Appropriate safeguards” as defined by
Article 28 PDPA when using service providers as set forth in the section “Recipients of
personal data” are provided by standard data protection clauses as approved; or
adopted by the Personal Data Protection Committee, binding corporate rules, or similar
instruments.

Once your account is deleted, we will retain your personal data for a given period of time and process your personal data properly according to Personal Data Protection applicable laws and our internal rules for inquiry reply, disputes resolution or fee collection, detection and deterring fraudulent use of, or abuse of, our services.

6. What is your choices regarding your personal data

As a data subject affected by data processing, you have the following rights, information (Article 30 and 31 PDPA); rectification (Article 35 and 36 PDPA); data erasure (Article 32 PDPA); restriction of processing (Article 34 PDPA); data portability (Article 30 and 31 PDPA); Right to object for reasons relating to your particular situation, you have the right to file an objection at any time to processing of your personal data based on the performance of a task carried out in the public interest or in the exercise of official authority vest in the Gekkon Company Limited according to Article 24 Para 1. (4) PDPA or data processing based on a consideration of interests according to Article 24 Para. 1 (5) PDPA. If you file an objection, we will continue to process your personal data only if we can document mandatory, legitimate reasons that outweigh your interests, rights, and freedoms, or if processing is for the assertion, exercise or defense of legal claims. To exercise your right of objection send us an email to [email protected].

7. Complaints

If you feel that the processing of your personal data is in breach of legal requirements, you have the right to file a complaint with the responsible data protection supervisory authority according to Article 73 PDPA.

8. More information on personal data processed

While using Gekkon service, we may require you to provide us with your (1) last name, first name, other names or patronymic (if specified in the ID-card), (2) date, month and year of birth, (3) place of birth, (4) individual identification number if applicable, (5) the issuing authority, the date of issue and validity period, the series and number of the ID-card (or its substitute), (6) information about the registration address at the place of residence, (7) driving license data (issuing authority, issuance date and validity period, series and number of the driving license, category driving license, (8) contact details, including but not limited to mobile phone number, e-mail address, (9) information on the presence (absence) of medical contra-indications to the use of the vehicle, (10) photography, (11) data on the place of work and position held, (12) geolocation data (navigational data), (13) advertising ID for the purposes of identification of the user ́s devise at starting the rent, un/locking the vehicle, and (14) any other personal data related or which may be created in connection with the conclusion and performance of a contract to which you are party. The information that we request will be retained by us and used as described in this Privacy Policy.

9. More information on personal data processing purposes

9.1 Fraud prevention and identification check

Gekkon checks your personal customer data against sanction lists and compliance lists within the framework of legal requirements and within its own legitimate interests. For fraud prevention purposes, Gekkon carries out an identity check which is done by our service provider Sum and Substance Limited, incorporated and registered in England with company number 09688671,
whose registered office is at 80 Wood Ln Central Working White City London W12 0BZ, as part of a manual reconciliation process. If you decide to validate your driving license and ID card via our Gekkon App, the images you have taken of your driving license, ID card and the portrait picture you have taken yourself will be collected and processed for the purposes of validating your driving license and ID card. The driving license data and ID card are read out electronically from the pictures of your driving license you have taken, and the pictures of your face are compared with the driving license/ID card pictures (face match). These images are stored as permanent proof of driving license/ID card control. These image files are verified by our service provider Sum and Substance Limited, incorporated and registered in England with company number 09688671, whose registered office is at 80 Wood Ln Central Working White City London W12 0BZ, as part of a manual reconciliation process. Gekkon processes the position data (start and end position) of its vehicles in order to analyze the use of its fleet. Such data is also used to develop a statistical model which is able to predict a possible future demand for Gekkon vehicles. For such purposes only data without a direct link to a natural person is being processed. To the extent data processing is based on the balance of interest test and thus legitimate interests, more information about the balance of interest test is available upon request.

9.2 Rent

To start and terminate the individual lease of our Gekkon vehicles, it is necessary that we record the starting position and final position, the distance driven, the quantity of fuel used and the time and date of lease. Gekkon processes your personal data provided in course of the registration for our services in order to set up your customer account and to contact you for contract related purposes. This also includes the validation of a driving license with one of our validation partners. In this context, we collect your driving license data to ensure that you have the appropriate driving license. If you contact our customer service by email or telephone, Gekkon collects the information and data (including personal data) provided by you in order to be able to process your request. A further collection and processing of your personal data, such as a call recording for improving our customer service, will only take place if you have given your consent. If you use a vehicle of another Gekkon entity in another country, Gekkon transfers your personal data provided by you during the registration and validation to this Gekkon entity to enable the rental. In the event of an accident with the Gekkon, we process the personal data collected in connection with the accident in order to settle damage claims with the other party involved in the accident and/or with our and/or the other party's insurance company. The aforementioned processing of personal data may also be based on the legitimate interests of Gekkon. We process personal data from you on the basis of lawfulness of processing under Article 24 PDPA, on the basis of the legitimate interests of Gekkon with regard to the processing. Gekkon also processes your personal data collected during the individual lease process in order to identify and rectify possible errors and malfunctions in the rental process and in the overall operation of services. Gekkon may transfer your personal customer data (name, address) to third parties, if this is necessary to enable the respective third parties to establish contact with the respective customer and to directly raise claims towards the customer in the case of not obviously unfounded claims of such third parties asserted against Gekkon, which arise from parking violations in private space. Gekkon may transfer your personal customer data to governmental authorities, courts, external advisors, and similar third parties that are public bodies or authorized third parties (e.g. mobility platform providers) as required or permitted by applicable law e.g. if the processing is necessary for the purposes of the legitimate interests pursued by Gekkon. This may for example be the case, if you have committed an administrative offense during an individual lease.

9.3 Marketing

To provide you with information and advice from Gekkon about our products and services and to provide you with particular offers (e.g. on events or special offers) in writing, in a verbal communication, or communication via electronic mail (email, SMS, messenger, push messages). If you have consented, your personal data may also be collected and processed to apply analytical methods including profiling to measure and evaluate your interests. Such execution is operated for the purpose of further individualizing the contact between Gekkon and you. The processing may include that online usage behavior and social media usage is being collected and processed. We process your personal data on the basis of your consent with information of cooperation partners of Gekkon about their products and services. Creation of user profiles to improve our services and adapt our products even better to your needs. Gekkon links data about the use of our products and services with your profile and can thus inform you according to your interests. This also includes, for example, that your use of our website or our app is recorded and evaluated together with your personal customer data. Conducting personalized market research and opinion surveys for quality assurance purposes and improving our own services and products. In order to improve our own services and products, personal customer data resulting from the use of Gekkon vehicles that have been consented from the customer. It also includes position and transaction data that arise during the use of mobility services. If you use corresponding mobility or networked vehicle services, position and movement data (in particular GPS data) are generated. We can process the data transmitted to us from the vehicle for this purpose to evaluate, for example, in which area and when you use mobility offers or track your vehicle position. This way we can point out suitable promotions or show you available mobility offers in your area when you park your vehicle. Such collecting and processing this data, enables Gekkon to better analyze our products and to ultimately improve us for other our customers.

10. Are you obligated to provide your personal data and what happens if you do not provide it?

The provision of the personal data is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract is mandatory, otherwise we would not be able perform such a contract or in a position to take steps at your request. The provision of other personal data is voluntary. In the event that you do not wish to provide your personal data as part of your consent, you can still use our services. However, we may not be able to offer you the services and products requiring your consent. Furthermore, Gekkon may transfer your personal data to the recipients and/or categories of recipients described below.

11. More information of third parties involvement

Gekkon uses external IT service providers who provide us the server infrastructure, IT maintenance tasks or extensive IT solutions (such as cloud services) and software solutions on behalf of Gekkon. Gekkon uses external service providers for invoice archiving purposes. Governmental authorities, courts, external advisors, and similar third parties that are public bodies or other authorized third parties, provided that the facts described above are present (e.g. parking offence or administrative offences or a legal obligation to provide information or account suspension due to unauthorized use). For the organization of marketing activities and promotions, personal customer data are partly transferred to service providers used for these purposes. Gekkon uses external service providers for market research purposes. Gekkon transfers your personal data to shipping companies if processing is required for communication by post. In

the event of an accident with an Gekkon vehicle, customer data is transferred to insurance companies and if applicable, to the other party involved in the accident. Gekkon uses external service providers to ensure the safety and cleanliness of the vehicles and to find any lost objects. For this purpose, vehicle related and in some cases driver related data are transferred to these service providers. Gekkon uses external service providers to provide our customer service. For this purpose, personal customer data is transferred to these service providers. For the validation of driving licenses at Gekkon validation partners, Gekkon uses these partners as service providers. For this purpose, personal customer data is transferred to these service providers. Gekkon processes your data in countries where the Kingdom of Thailand has established an adequate level of data protection. In the following cases, processing takes place in countries where the Kingdom of Thailand has not established an adequate level of data protection. We have ensured an adequate level of data protection by providing for appropriate safeguards, in particular, by entering into agreements with the recipients of personal.

12. More information on the term of storage of the data

Gekkon stores your personal data for as long as this personal data is necessary for the fulfilment of the purpose the data has been collected for. In addition, Gekkon stores personal data as required by legal regulations and stores until the expiry of applicable limitation periods in order to be able to assert any existing legal claims.

13. Please take note that you have certain rights in relation to our processing of your personal data under legal regulations:

Information about and access to your personal data – you have the right to obtain confirmation explanation as to whether your personal data are being processed by us and, where that is the case, to access and receive information about your personal data.
Rectification of personal data – you have the right to have your personal data rectified if they are inaccurate our outdated.
Erasure of personal data – you have the right, in certain situations, to have your personal data erased.
Object to processing – you have the right to object to processing where your personal data are being processed for direct marketing purposes.
Data portability – you have the right to have your personal data transferred by us to another organization, if you have provided us with this data and we are processing it based on your consent.

In the event of you have given Gekkon consent to data processing, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. You also have the right to lodge a complaint with the competent data protection supervisory authority, where you believe that the collection, use, and disclosure of your personal data is unlawful or non-compliant with the PDPA. To exercise your rights as mentioned above, please send us an email to [email protected]. If you have doubts as to whether we are adhering to the obligations associated with personal data processing, please contact us or Personal Data Protection Committee Office (Tel. 02 142 1033 or 02 141 6993), having its principal office at No. 120, Moo. 3, 7th floor, the Government Complex Commemorating His Majesty, the King’s 80th birthday anniversary (Building B), Chaengwattana RD, Thungsonghong Sub-district, Lak-si District, Bangkok 10210.

14. Changes to the Privacy Policy

This Privacy Policy may require an update from time to time – e.g. due to the implementation of new technologies or the introduction of new services. We reserve the right to change or supplement this Privacy Policy at any time. We will publish the changes on www.gekkon.me and inform you via email accordingly.