This Privacy Notice(this “Notice”) is prepared by Road Accident Victims Protection Company Limited (the “Company”). This Notice purposes to notify the Data Subject (the “Data Subject” or “You”) of the collection, usage, or disclosure of your personal data as well as your legal rights with respect to your personal data.
The Company has collected, used, or disclosed your personal data under the Personal Data Protection Act B.E. 2562 (A.D. 2019). Therefore, the Company would like to notify you of the Privacy Notice as following.
1. Definition
In this Notice
“Personal Data” shall mean any information relating to a person, which enables the identification of such Person, whether directly or indirectly, but not including the information of the deceased persons in particular.
2. Personal Data Collected by the Company
2.1 General Personal Data such as name, surname, identification card number, date of birth, passport number, address, e-mail address, telephone number, bank account number, driving license number, motor vehicle registration number, motor vehicle chassis number, agreement number, photograph, video, and any other relevant information under the insurance agreement, etc.
2.2 Sensitive Personal Data such as nationality, health information, disability, Criminal Record Data, Biometric Data, etc.
You are required to provide your personal data for the purposes of engaging the Company’s services or entering into any insurance agreement or exercising the rights to preliminary compensation, and/or compensation under the Road Accident Victim Protection Act.
In the case that the Company is required to collect your personal data to perform its legal duties or enter into the agreement made with you, if you fail to provide certain information necessary for the Company’s operations, the Company may not fulfill the purposes or fully render services to you or you may be unable to appropriately engage the Company’s services and this may affect the compliance with any laws applicable to the Company or you.
If you provide the Company with the information of any third parties, you are required to comply with the Personal Data Protection Act. such as requesting consent or notifying the third parties of this Policy on the Company’s behalf to enable the Company to continue its operations under the purposes stipulated in this notice and the Office of Insurance Commission’s Personal Data Protection Notice.
3. Sources of Personal Data
The Company collects your personal data through the following channels:
3.1 The Company directly receives the personal data from you;
3.2 The Company receives your data through websites, mobile applications, documents, agents/brokers, and banks which are the agents to sell the Company’s insurance policies, foundations, rescuers, responders, and network partners of reliable public information sources. The Company prescribes that the relevant officers shall strictly comply with the policies and practices on personal data management.
4. The Company’s Purposes of Collection, Usage, and/or Disclosure of Personal Data
The Company collects, uses, or discloses your personal data for the following purposes:
Purposes |
The legal basis for collecting, using, or disclosing personal data. |
1. To comply with any insurance agreements or requests of the data subjects before entering into insurance agreements or to perform any other acts to enable the data subjects to access their rights under the insurance agreements, Road Accident Victims Act, Non-life Insurance Act, and Life Insurance Act. |
It is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract, in accordance with Section 24(3) of the Personal Data Protection Act B.E. 2562 (A.D.2019). |
4. To collect, use, and/or disclose any personal data to the Office of Insurance Commission(OIC) for the purposes of supervision and promotion of insurance business under the Insurance Commission Act. and Non-life Insurance Act in accordance with the OIC’s Personal Data Protection Notice available at its website (https://www.oic.or.th) |
It is necessary for compliance with a law to which the Data Controller is subjected in accordance with Section 24(6) of the Personal Data Protection Act B.E. 2562 (A.D.2019). |
5. To fulfill the operational purposes assigned to the Company by the applicable laws, articles of association, or government agencies. |
It is the compliance with the legal obligations of the data controller in accordance with Section 24(6) of the Personal Data Protection Act B.E. 2562 (A.D.2019). |
10. To prevent or suppress any hazards to your or others’ lives, bodies, or health. |
It is for preventing or suppressing a danger to a Person’s life, body or health in accordance with Section 24(2) of the Personal Data Protection Act B.E. 2562 (A.D.2019). |
11. To prepare information and statistics for the purpose of rendering services under insurance agreements. |
It is for the achievement of the purpose relating to the preparation of the statistics in accordance with Section 24(1) of the Personal Data Protection Act B.E. 2562 (A.D.2019). |
12. To prepare information for education, research, usage, and dissemination for the campaign of road accident reduction or for public benefits. |
It is necessary for the performance of a task carried out in the public interest by the Data Controller in accordance with Section 24(4) of the Personal Data Protection Act B.E. 2562 (A.D.2019). |
If you have provided the Company with the consent for collection, usage, and/or disclosure of your personal data, you are entitled to withdraw such consent at any time. Unless there are legal or contractual limitations on such withdrawal that benefit you, your withdrawal of consent shall not affect any activities of collection, usage, or disclosure of your personal data to which your consent has been provided before such withdrawal.
5. Disclosure of Your Personal Data
The Company may disclose your personal data to the following third parties or external entities:
5.1 Any government or other agencies in accordance with missions, authorities, laws, and international and domestic obligations of operations of the Office such as the Office of Insurance Commission, Anti-Money Laundering Office, Bank of Thailand, National Anti-Corruption Commission, Office of the Securities and Exchange Commission, Royal Thai Police, etc.;
5.2 Relevant third parties and external entities, namely, insurers, the Thai General Insurance Association, general insurance brokers, general insurance agents, loss adjusters, actuaries, surveyors, re-insurers, the Office, Thai branches of foreign insurers, hospitals, rescue centers, the Medical Council of Thailand, Revenue Department, CCTV management center, insured persons, policyholders, premium payers, vehicle possessors, witnesses, beneficiaries, statutory heirs, stakeholders, litigants, parties, injured persons, attorneys, creditors, or debtors of the Company, any persons and entities relating or entering into transactions or contacting the Company, any entities relevant to insurance activities, etc.;
5.3 Banks, financial institutions, or service providers relevant to receiving payment and payment;
5.4 Service providers delegated to perform actions on the Company’s behalf concerning insurance, compensation, legal actions, audit, and other actions relevant to the insurance agreement;
5.5 Government agencies or entities delegated by the government;
5.6 Entities relevant to road safety.
6. Transmission or Transfer of Personal Data to Overseas
The Company may be required to transmit or transfer your personal data to foreign service providers or other recipients. The Company shall use its best endeavor to transmit or transfer your personal data to trustworthy foreign service providers or other recipients with the safest methods to safeguard your personal data which shall include the following cases:
6.1 To comply with any applicable laws;
6.2 You have been informed of the insufficient personal data protection standard of the destination country;
6.3 To comply with any agreements or your requests before entering into the agreement;
6.4 To comply with any agreements between the Company and other persons or legal entities for your benefit;
6.5 To prevent or suppress any hazards to the life, body, or health of you or other persons while you are unable to provide consent;
6.6 To perform missions for significant public benefits.
7. Personal Data Retention Period
The Company shall retain your personal data for a period not exceeding 10 days from the date of termination of your relationship with the Company. After this period, the Company will delete, destroy, or anonymize your personal data unless the longer period is prescribed or authorized by the applicable laws.
8. Rights of Data Subject
You shall have the rights stipulated in the Personal Data Protection Act B.E. 2562 (A.D. 2019) as follows:
8.1 Right to access or request a copy of your personal data or disclosure of acquisition of personal data;
8.2 Right to request the Company to correct, complete, and update, and not misleading. If the Company is unable to fulfill the request, it must record the request along with the reasons in the log as required under Section 39.
8.3 Right to receive your personal data in readable format or commonly used by automated tools or devices and able for the use or disclosure of such data through automated means as well as right to request the Company to transmit or transfer your personal data to other data controllers when it could be automatically performed or request to directly receive your personal data transmitted or transferred to other data controllers by the Company unless it is not possible due to technical reasons;
8.4 Right to object to any collection, usage, and/or disclosure of your personal data at any time in accordance with the legal criteria;
8.5 Right to request the Company to delete or destruct or anonymize your personal data in accordance with the legal criteria;
8.6 Right to request the Company to suspend usage of your personal data in accordance with the legal criteria;
8.7 Right to make claims in the case that the Company or Data Processor and the Company’s employees or contractors violate or fail to comply with the Personal Data Protection Act B.E. 2562 (A.D. 2019) or any announcements issued by virtue thereof;
8.8 Right to withdraw your consent in accordance with the legal criteria. But this does not include personal data that is collected, used, or disclosed without consent as per Section 24, Section 26, and Section 27, paragraph one, of the Personal Data Protection Act B.E. 2562 (2019).
9. Security of Retention of Personal Data
The Company has provided security measures to prevent the loss, access, use, revision, modification, or disclosure of personal data without authorization or unlawfully, in accordance with the laws.
In the event of a personal data breach that poses a risk to the rights and freedoms of the data subject, the Company will notify to the Office of the Personal Data Protection Committee within 72 hours of becoming aware of the breach. If the breach presents a high risk to the rights and freedoms of the data subject, the Company will promptly notify the data subject of the breach along with remedial measures without delay.
10. Amendment of the Privacy Notice
The Company shall review and update this notice to ensure its alignment with the conditions for collecting, using, or disclosing personal data. In the event of an update, the Company will inform you through its website or other designated channels.
11. Exercising the Rights of Minors/Quasi-Incompetent Person/Incompetent Person
11.1 Minors, the consent shall be obtained from the holder of parental responsibility over the child.
11.2 Quasi-Incompetent Person, the consent must be obtained from the curator who
has the power to act on behalf of the quasi-incompetent person.
11.3 Incompetent Person, the consent must be obtained from the custodian who has the power to act on behalf of the incompetent person.
12. The Company’s Contact Channels
In the case that you have any questions concerning the collection, usage, and/or disclosure of your personal data or wish to exercise any rights of the data subject, please contact the Company at:
Contact Details of the Company
Name: Road Accident Victims Protection Company Limited
Address: No. 26, Sukhumvit 64/2 Alley, Sukhumvit Road, Phra Khanong District,
Phra Khanong Tai Sub-district, Bangkok Metropolis 10260
Tel: 02-100-9191
Working Hours: 08.30 AM – 05.00 PM
Contact Details of the Data Protection Officer (DPO)
The contact details of the Data Protection Officer of Road Accident Victims Protection Company Limited are as follows:
Address: No. 26, Sukhumvit 64/2 Alley, Sukhumvit Road, Phra Khanong District,
Phra Khanong Tai Sub-district, Bangkok Metropolis 10260
Tel: 02-100-9191
Working Hours: 08.30 AM – 05.00 PM
The Privacy Notice for Insured and Victims in accordance with the announcement no. ก 015/2566 regarding ‘Amendment of Attached Documents no. 001/2566’ has been withdrawn and it shall apply the Privacy Notice for Insured and Victims as outlined in this document instead, effective from 1st February 2025 onwards.