Notice of Processing on Personal Data

Ninja Logistics (Thailand) Limited (“Ninja Van”), as a controller of Personal Data, is bound by Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). In processing individual’s Personal Data, Ninja Van is required to comply with PDPA including the obligation to notify the data subject pursuant to this Notice, and for certain cases, obtaining consent from data subject pursuant to the attached Consent Form.

1.Collection of Personal Data

Ninja Van may, directly or indirectly, collect Personal Data of a data subject from the following sources:

  • Data subject, his representative or other related persons;
  • Person or company who uses Ninja Van’s delivery service;
  • Business partner and/or agent of Ninja Van such as convenience stores or Ninja Van Store;
  • Ninja Van’s services through various channel such as branches, including telephone service (Call Center), and e-mail;
  • Ninja Van’s digital services including website, application or social medias; and
  • Any reliable sources such as governmental organization

2.Types of Personal Data 

"Personal Data" refers to any information relating to a person, which can identify such person. Depending on purposes of use, Ninja Van may collect various types of Personal Data including:

  • Personal information such as name, gender, date of birth, and details on ID card, passport or driving license;
  • Contact information such as address, telephone number, email address and social media data;
  • Payment information such as bank account and credit card information;
  • Family information such as name and contact information of family members;
  • Electronics information such as IP address, types of browser, unique device identifiers, activities records, website usage history, Cookies, and location; and
  • Other information relating to Ninja Van’s services such as Voice recorders via telephone including comments or complaint, or other activities which a data subject communicates with Ninja Van via telephone

3.Retention Period

Ninja Van will retain Personal Data of a data subject so long as the purpose for collecting remains. After that, Ninja Van will erase and destruct such Personal Data, except as may be required by applicable laws or for protection of Ninja Van’s interest. In general, Personal Data will be kept for a maximum period of 10 years or otherwise longer if it is specifically provided by law.

4.Purposes of Use and Disclosure

Ninja Van may process Personal Data of a data subject: (i) to perform Ninja Van’s contract obligations (“Contractual Obligations”), (ii) to enable Ninja Van to comply with legal obligations (“Legal Obligations”), (iii) based on Ninja Van’s legitimate interests (“Legitimate Interests”) and (iv) if required, upon consent given by the data subject (“Consent”). In this respect, Ninja Van will use and disclose your Personal Data for the following purposes.


Processing AreaDetails of ActivitiesBasis of Processing

Logistics services provided by Ninja Van such as the delivery service or cash on delivery services


Providing the services as per the service contract between Ninja Van and the service recipient, including the use of Personal Data of a third party receiving from the service recipient.

Contractual Obligations 

Legitimate Interests


Logistics services management and development 


Managing and operating Ninja Van’s business in accordance with the internal policy and process, including developing efficiency of logistics service, tracking and analysing the shipping, facilitating contact between the shipper and the end recipient.

Contractual Obligations 

Legitimate Interests


Tracking and analytics of your delivery Notifying the status of the order or the shipment and updating the shipping status.Contractual Obligations 

Order processing 


Processing orders a data subject submits through the platform. Payments that a data subject makes through the platform for products, whether sold by Ninja Van or a third-party seller, will be processed by Ninja Van’s agent. Ninja Van may pass Personal Data of a data subject on to a third party in order to deliver the product to the end recipient (for example to Ninja Van’s courier or supplier).Contractual Obligations 

Suggestion and response to queries


Contacting a data subject in regard of his suggestion after or during the shipment, including responding and handling queries and requests of a data subject, resolve complaints, problems or disputes.

Contractual Obligations 

Legitimate Interests

Surveys and marketing research for Ninja Van’s logistic services 


Conducting surveys and marketing research on a data subject’s preferences in order to provide logistic services, to develop the services and to evaluate the result of Ninja Van’s advertisement through various channels.

Consent


Administration of user account


Administering a data subject’s account (if any), facilitating the use of the account, providing Ninja Van’s service, verifying the identification, rechecking and proceeding financial transaction, monitoring any download from the platform, adjust layout and/or content of the platform (including personalization), identifying the users within the platform, conducting research on the information of Ninja Van’s users and their behaviors, providing a data subject information which Ninja Van thinks it might be beneficial to a data subject or as requested by a data subject (including information relating to Ninja Van or third parties, products and services of other sellers).

Contractual Obligations 

Legitimate Interests

Legal Obligation 

Consent


Ninja Van’s dashboard

Ninja Van’s Shipper Portal


Administering the service recipient’s user and to facilitate the service recipient


Contractual Obligations 

Legitimate Interests


Contact Us page on Ninja Van’s website.


Direct communication through the website


Contractual Obligations 

Legitimate Interests


Facebook 

Facebook messages


Direct communication through Facebook messages 


Contractual Obligations 

Legitimate Interests


Cash on Delivery Service (COD service)


In order to provide COD service, Ninja Van must use Personal Data of a data subject e.g. name, address, telephone number for provide logistics services. Such Personal Data may be received from a third party or Ninja Van’s affiliates.

Contractual Obligations 

Legitimate Interests


Fraud Investigation Conducting investigation, preventing, auditing fraud, violation to security or non-compliance with the lawsLegitimate Interests

Marketing and promotion 


When a data subject registers an account with Ninja Van or otherwise provide Ninja Van with his Personal Data through the platform, Ninja Van will also use his Personal Data to send him marketing and/or promotional materials about Ninja Van’s or third-party sellers’ products and services from time to time. Ninja Van may use his contact information to send newsletters from Ninja Van and from Ninja Van’s related companies. A data subject can unsubscribe from receiving marketing information at any time by using the unsubscribe function within the electronic marketing material.

Consent

 

Advertisement materialsPromoting or adverting Ninja Van through Ninja Van’s online channels (e.g. Ninja Van’s website or social media) by using interview videos between a data subject and Ninja Van and pictures of a data subject.

Contractual Obligations 

Legitimate Interests

Marketing activities e.g. GamesLaunching and administrating contest or game in Facebook Page 

Contractual Obligations 

Legitimate Interests

Research for developing service quality and Ninja Van’s businesses


Developing, improving and maintaining the quality of products and services including market research and research for the development of Ninja Van products and services, for example, Ninja Van may monitor or record phone calls and customer-facing interactions for quality assurance, or conducting research and analytics to enable Ninja Van to better understand the location, preferences, demographic, and to improve Ninja Van’s service delivery and the customer experience at Ninja Van’s respective touchpoints.

Legitimate Interests


Verification purpose


Comparing information and verifying with third parties in order to ensure that the information is accurate.Legitimate Interests

Compensation claim 


Proceeding the claim on compensation or other payment which may occur in accordance with Ninja Van’s policy.


Legitimate Interests


Exercising legal rights 


For exercising legal rights or for any legal purpose including but not limited to requesting for legal advice and dispute resolution. 

Legitimate Interests

Legal Obligations

Accounting and risk management 


For accounting purposes, risk management, compliance and record.


Legitimate Interests

Legal Obligations


Compliance with laws


Ninja Van may need to disclose Personal Data for complying with any applicable rules, laws, regulations, codes of practice or guidelines issued by any legal or regulatory bodies which are binding on Ninja Van

Legal Obligations



In the case where Ninja Van appoints third-party service provider(s) to process Personal Data of a data subject, Ninja Van will process such Personal Data for the purposes of performing Ninja Van’s contractual obligations, compliance with legal obligations, based on Ninja Van’s legitimate interests or based on consent given by the data subject (if necessary). Ninja Van will not disclose or permit the disclosure or make available Personal Data of a data subject other than in accordance with the relevant ground unless a prior consent of the data subject has been given to Ninja Van or PDPA allows Ninja Van to do so without obtaining consent from the data subject.

If any data subject could not share Personal Data necessary for Ninja Van to process Personal Data based on the basis of Contractual Obligations, or Legal Obligations, Ninja Van will not be able to perform its Contractual Obligations with such data subject nor able to comply with Legal Obligations. 

Ninja Van will process Personal Data in strict compliance with applicable laws. In case where a data subject has given a consent to any data processing activity, such data subject may withdraw his consent at any time.

5.Disclosure

Ninja Van will not disclose Personal Data of a data subject without any lawful basis. Such Personal Data may be disclosed, or transferred to governmental organizations, governmental bodies or third parties including:

  • Group company or affiliate within Ninja Van group; 
  • Business partners of Ninja Van who involve in Ninja Van’s services;
  • Person or company that a data subject makes payments to or receives payments from;
  • Third-party service providers such as courier, and cloud service provider; 
  • Advisors such as financial advisors or legal advisors;
  • Governmental and regulatory bodies;
  • Insurance company;
  • Other data controller to whom a data subject has previously disclosed or transferred data; and
  • Any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition or takeover, including any transfer or potential transfer of Ninja Van’s rights or duties under the agreement with a data subject.

In the event where Ninja Van is required to disclose Personal Data of a data subject to a third party, Ninja Van will follow appropriate procedures to ensure that the third party will properly handle such Personal Data in order to prevent data loss, unauthorized access, improper use, modification, disclosure or processing.

6.Right of Data Subject

In exercising any right under this Clause 6, a data subject shall comply with criteria and procedures specified in Clause 7 of this Notice. However, the rights specified in this Clause 6 are subject to change as the relevant law may be amended from time to time by the government. Ninja Van will inform the data subject about the changes.  

  1. Right to be notified: If Ninja Van wishes to collect, store, use or disclose Personal Data of a data subject in any manner beyond the intended purposes or consent given by such data subject, Ninja Van will notify and/or seek his prior consent with respect to such additional scope.
  2. Right to Access to Personal Data: A data subject may request for a copy of his Personal Data and request to disclose about the source of his Personal Data. 
  3. Rectification of the Personal Data: To ensure that Personal Data of a data subject is accurate, up-to-date, complete and not misleading, a data subject may file a request to rectify any of his Personal Data that has been changed by following the procedures specified in Clause 7. 
  4. Right to data portability: In case where it is technically available for Ninja Van, a data subject may request to receive his Personal Data in a commonly used or readable by the automatic device or to automatically transfer.
  5. Right to erasure of Personal Data: A data subject may request to erase or make his Personal Data pseudonymised under any of the following circumstances: (a) his Personal Data is no longer needed to be collected, stored, used or disclosed for the intended purposes, (b) a data subject withdraws his consent for his Personal Data to be collected, stored, used or disclosed and Ninja Van no longer has any legal right to process such Personal Data for the intended purposes, (c) a data subject objects to Ninja Van’s processing of his Personal Data, or (d) his Personal Data was processed in contravention of the PDPA. 
  6. Request to suspend the use of Personal Data: A data subject may request Ninja Van to suspend its use of his Personal Data in any of the following events: 
  7.  when Ninja Van is in the process of verifying certain information for the purpose of rectifying, updating, completing or avoiding any misleading about his Personal Data upon his request;
  8. when his Personal Data is to be erased under Clause 6.5 but such data subject instead requests to suspend its use;
  9. when it is no longer necessary to store his Personal Data, but a data subject requests Ninja Van to continue the storage of his Personal Data for establishing legal claims, legal compliance, exercise of legal rights or defenses; or
  10. when Ninja Van is in the process of verifying its legitimate rights in its data collection or processing for purposes specified by law.  
  11. Right to object the processing of Personal Data: A data subject may object to the collection, storage, use or disclosure of his Personal Data in any of the following events:
  12. In case where his Personal Data was collected by Ninja Van for the purpose of (a) public interest of Ninja Van, (b) Ninja Van’s compliance with a governmental order or (c) any legitimate interest of Ninja Van or other legal entity;
  13. In case where Ninja Van has processed his Personal Data for the purpose of direct marketing; and
  14. In case where Ninja Van has processed his Personal Data for any research purposes as specified in relevant laws, including for statistical purpose. 
  15. Right to withdraw consent: A data subject may withdraw his consent at any time. His withdrawal will not have any effect on Ninja Van’s previous data processing. If his withdrawal will affect any part of such Personal Data, Ninja Van will notify a data subject of such effect at the time he makes such withdrawal.

However, Ninja Van may deny the request to withdraw consent if the processing is for the purpose of, or for complying with, applicable law or court order, the withdrawal may adversely affect and harm the rights and freedom of the data subject himself or other people, the processing is for research purposes that has appropriate protection for Personal Data, or the processing is for establishing legal claims, legal compliance, exercise of legal rights or defenses.

7.Criteria and Procedures for Exercise of a Data Subject’s Rights  

  • If a data subject wishes to exercise his right, please submit his request to th-privacy@ninjavan.co.
  • A data subject may download a request form, power of attorney, and other relevant documents from Ninja Van’s website https://www.ninjavan.co/th-th/privacy-policy  or request them from th-privacy@ninjavan.co.
  • A data subject must complete and sign the request form and submit it with a certified copy of his ID card or passport.
  • If a data subject appoints someone to submit the request on his behalf, a power of attorney in the form specified by Ninja Van is also required.
  • The request will be sent to Ninja Van’s data protection officer for verification of the identity. 
  • In verifying the identity, if the identity of a data subject and/or the person authorised under the power of attorney cannot be verified, Ninja Van may request for additional documents or may contact for additional information. 
  • The data protection officer will consider the request by considering various factors such as its legitimate reasons, its negative effect on a third party etc. and whether the PDPA provides for any exemptions.
  • If the request is approved, the data protection officer will proceed and report the result to the data subject without delay via the channel specified in the request.
  • If the request is denied, the data protection officer will notify a data subject with explanation without delay via the channel specified in the request. A data subject may make an appeal to the authority as prescribed by the PDPA which Ninja Van will inform a data subject in Ninja Van’s notification of such denial.  

Remark: 

  1. The procedures above will take no more than 30 (thirty) days following the receipt of the request and all supporting documents.
  2. Ninja Van’s process will not incur any costs.  But if there is any cost, Ninja Van will notify a data subject prior to taking any action. 
  3. In case Ninja Van rejects the request, a data subject may file a complaint to Personal Data Protection Committee at the following address:

Office of the Personal Data Protection Committee
Ministry of Digital Economy and Society
Telephone: 02-142-1033
E-mail: pdpc@mdes.go.th

8.Contact Information 

If a data subject has any questions relating to an exercise of his rights or his given consent, a data subject may contact Ninja Van at:  

Name: Data Protection Officer, Ninja Logistics (Thailand) Limited
Address: 101, 5th Floor, Room 5-A2, Sukhumvit Road, Bang Chak, Phra Khanong, Bangkok, 10260
Telephone: +66 2026 1499
E-mail: th-privacy@ninjavan.co