Urban Studio 2021 Co., Ltd. (hereinafter referred to as the ‘Company’) is a subsidiary of Kitti Group Co., Ltd.

The Company would like to inform you that the Company is aware of the importance of the privacy of customers, service users, and other persons involved in the Company’s services.

Therefore, the Company would like to inform you of the Company’s Personal Data Protection Policy in the collection. The Company would like to clarify the details. How to Collect, Use and/or Disclose Data Protection Data Access, Transfer, and Analysis of Your Personal Data as follows

“Personal Information” means the information used to register on the Company’s website. Providing information through the Company’s applications or other applications. Messages sent to the Company through the LINE program, as well as providing information by sending the Company’s email messages, cookies, transaction information, and usage history.

Under the Personal Data Protection Act B.E. 2562 (2019), the Company has established this Personal Data Protection Policy, and the Company has the legal status of being called the ‘Data Controller’. The Company requires employees assigned by the Company to have specific duties to carry out the collection of The Company’s personal data is used or disclosed in accordance with the Company’s instructions or on behalf of the Company, with the legal status of being called a ‘Personal Data Processor’, and customers, service users, as well as other persons involved in the provision of services, are considered as ‘Data Subjects’ in accordance with the provisions of this Law.

1. Personal Data Collected, Used and/or Disclosed by the Company

The Company collects personal information, which is information that enables the identification of customers. The information provided by you directly or indirectly from the Company’s registration includes information provided by you directly from the Company’s registration. Providing information through the Company’s applications or other applications. Messages sent to the Company through the LINE program, as well as providing information by sending the Company’s email messages, cookies, transaction information, and usage history through the website or any other channels as follows:

• Contact information, such as residential Workplace, phone number, email, LINE ID.
• Device or tool information, such as IP Address, MAC Address, Cookie ID
• Other information such as website usage, sound, still images, animations, and any other information that is considered personal data under the Personal Data Protection Law.

2. Purpose of Collection, Use and/or Disclosure of Information

We will use your information for the purpose of creating To prepare and improve the website of the customer or service user, as well as various online platforms and other social media channels, in order to achieve the success of the work as a website or various online platforms that can be fully used in electronic media according to the wishes of the customer.

If there is a change later. Further, amend the purpose of collection, use and/or disclosure of information from the previous notification. The Company will notify you to obtain consent again and provide a record of the amendment as evidence.

The Company will not collect, use or disclose your Personal Data for any purpose other than the purpose notified to you before or at the time of collection.

3. Protection of Personal Data

The company will ask for your consent first. Data Collection We will use or disclose your information by obtaining our explicit consent. In writing or electronically.

The Company has the following personal data protection policy:

3.1 The Company has put in place appropriate security measures. To prevent the loss, access, use, alteration, correction or unauthorized disclosure of personal information. The Company will conduct a review of such measures when necessary or when technology changes to make treatment effective. Appropriate security and safety shall comply with the minimum standards set by law.

3.2 In the event that personal data is required to be provided to a person or juristic person other than the data controller. The Company will prevent such person from using or disclosing personal data without authority or improperly.

3.3 The Company has established an audit system to delete or destroy personal data upon the expiration of the period. The retention period is irrelevant or unnecessary for the purpose for which the Personal Data was collected, or as requested by the Data Subject, or where the Data Subject has withdrawn consent, unless it is retained for the purpose of exercising freedom of expression. Retention for the purposes of the Personal Data Protection Act under Section 24 (1) or (4) or Section 26 (5) (a) or (b) for the purpose of establishing legal claims. The provisions of Section 33, paragraph five shall apply to the deletion or destruction of personal data by mutatis mutandis.

3.4 The Company will notify the Personal Data Breach to the Office of the Personal Data Protection Commission without delay within seventy-two hours. Unless such violation is not a risk of affecting the Rights and freedoms of individuals In the event that the violation has a high risk of affecting the rights and freedoms of individuals, the Company will notify the Data Subject of the violation of the violation along with remedial measures without delay. However, Such notification and exceptions shall be in accordance with the rules and procedures announced by the Personal Data Protection Committee.

The Company does not impose any consent to collect, use, or disclose personal data that is not necessary or relevant for entering into a contract or accessing the Services, and you may withdraw your consent at any time. The withdrawal of consent does not affect the collection, use or disclosure of personal data that you have given your consent to.

In the event that the Data Subject is a minor who has reached the age of majority by marriage or does not have the status of a person who has reached the age of majority under Article 27 of the Civil and Commercial Code. The Company will seek the consent of the Data Subject. as follows

(1) In the event that the consent of the minor is not any act in which the minor may give consent alone as provided in Section 22, Section 23 or Section 24 of the Civil and Commercial Code; The Company must first obtain the consent of the Guardian who has the authority to act on behalf of the minor.

(2) In cases where the minor is not more than ten years old; The Company will seek the consent of the authorized user of the administrative authority. acting on behalf of minors; In the event that the Data Subject is incapacitated, the request for consent from the Data Subject shall be required. The Company will seek the consent of the guardian who has the authority to act on behalf of the incompetent person. The Company will seek the consent of the guardian who has the authority to act on behalf of the quasi-incompetent person.

We will ensure that your information is accurate. It is current, complete, and non-misleading.

Clause 4. Exceptions to the Collection, Use or Disclosure of Personal Data

4.1. The Company will not collect Personal Data without your consent, unless:

4.1.1 To achieve the purpose of preparing historical documents or archives for the public interest, or related to research or statistics, which has provided appropriate protection measures to protect the rights and freedoms of the Data Subject.

4.1.2 To prevent or suppress danger to life The person’s body or health

   4.1.3 It is necessary for the performance of a contract to which the Data Subject is a party or for the processing of the request of the Data Subject prior to entering into the contract.

4.1.4 It is necessary for the performance of duties in the public interest of the controller. Personal Data or perform duties in the exercise of government authority granted to the Data Controller.

4.1.5 It is necessary for the legitimate interests of the Data Controller or of any person or juristic person other than the Data Controller, unless such interests are less important than the fundamental rights of the Data Subject.

4.1.6 To comply with the laws of the Data Controller.

4.2 The Company will not collect personal information about race, ethnicity, opinions, politics, creeds, religions or philosophies. Sexual behavior, criminal record. Health and disability information Trade union information, genetic information, biometric information, or any other information that affects the Data Subject in the same way as prescribed by law. without the express consent of the Data Subject, unless:

4.2.1 To prevent or suppress danger to life. The data subject cannot give consent. For any reason.

4.2.2 It is a lawful activity with appropriate protection of the Foundation. associations or non-profit organizations with political objectives. Religion, philosophy, or trade union to members, former members, or those who have regular contact with foundations, associations, or non-profit organizations for such purposes without disclosing such personal data outside the Foundation. associations or non-profit organizations.

4.2.3 เป็นข้อมูลที่เปิดเผยต่อสาธารณะด้วยความยินยอมโดยชัดแจ้งของเจ้าของข้อมูลส่วนบุคคล

4.2.4 เป็นการจำเป็นเพื่อการก่อตั้งสิทธิเรียกร้องตามกฎหมาย การปฏิบัติตามหรือการใช้สิทธิ เรียกร้องตามกฎหมาย หรือการยกขึ้นต่อสู้สิทธิเรียกร้องตามกฎหมาย

4.2.5 เป็นการจำเป็นในการปฏิบัติตามกฎหมายเพื่อให้บรรลุวัตถุประสงค์เกี่ยวกับ

(a) Preventive or Occupational Medicine Assessment of employee performance Medical Diagnosis Providing health or social services Medical treatment, health management, or social work systems and services. In the event that it is not in compliance with the law, the personal data is the responsibility of the professional or professional or the person in charge. Keep that personal information confidential by law. It must be the performance of a contract between the Personal Data Subject and the medical professional.

(b) Public health interests, such as health protection from contagious, dangerous or epidemic diseases that may be transmitted or spread into the Kingdom, or control the standards or quality of medicines, medical supplies or medical devices, which have provided appropriate and specific measures to protect the rights and freedoms of the Data Subject, especially the confidentiality of Personal Data in accordance with their duties or professional ethics.

(c) Labor protection, social security, national health insurance, welfare related to medical treatment of legal rights, protection of victims of motor vehicle accidents, or social protection, where the collection of personal data is necessary to comply with the rights or obligations of the data controller. The Company has put in place appropriate measures to protect the basic rights and interests of the Data Subject.

(ง) การศึกษาวิจัยทางวิทยาศาสตร์ ประวัติศาสตร์ หรือสถิติ หรือประโยชน์สาธารณะอื่น ทั้งนี้ ต้องกระทำเพื่อให้บรรลุวัตถุประสงค์ดังกล่าวเพียงเท่าที่จำเป็นเท่านั้น และได้จัดให้มีมาตรการที่เหมาะสมเพื่อคุ้มครองสิทธิขั้นพื้นฐานและประโยชน์ของเจ้าของข้อมูลส่วนบุคคล ตามที่กฎหมายได้กำหนดไว้

(จ) ประโยชน์สาธารณะที่สำคัญ โดยได้จัดให้มีมาตรการที่เหมาะสมเพื่อคุ้มครอง สิทธิขั้นพื้นฐานและประโยชน์ของเจ้าของข้อมูลส่วนบุคคล

ข้อมูลชีวภาพดังที่กล่าวแล้วข้างต้นให้หมายถึงข้อมูลส่วนบุคคลที่เกิดจากการใช้เทคนิคหรือเทคโนโลยี ที่เกี่ยวข้องกับการนำลักษณะเด่นทางกายภาพหรือทางพฤติกรรมของบุคคลมาใช้ทำให้สามารถยืนยันตัวตนของบุคคลนั้นที่ไม่เหมือนกับบุคคลอื่นได้ เช่น ข้อมูลภาพจำลองใบหน้า ข้อมูลจำลองม่านตา หรือ ข้อมูลจำลองลายนิ้วมือ

4.3 The Company will not collect Personal Data from sources other than directly from the Data Subject, unless:

4.3.1 Notify the Data Subject of the collection of Personal Data from other sources without delay. However, it must not exceed thirty days from the date of collection and consent from the Data Subject.

4.3.2 It is the collection of Personal Data that is exempt from the need to ask for consent as prescribed by law.

Clause 5. Period of Collection, Use or Disclosure of Personal Data

The Company will retain your information for a period of 3 years from the date of termination of the contract or the completion of the contract or services for the purposes of the parties.

The Company will notify you of the case where the Data Subject is required to provide Personal Data for compliance with the law or contract or it is necessary to provide Personal Data to enter into a contract, including the possible impact of not providing the Personal Data necessary for the purpose of a contract or service to the Company.

The Company has notified information about the Data Controller. Contact address and contact method have been provided to you. At the end of this Privacy Policy

Use or Disclosure of Personal Data

6.1 The Company will not disclose personal data without permission. Obtain the consent of the data subject, except for personal data that can be collected with exemption. There is no need to ask for consent as required by law. Individuals or juristic persons who receive personal data from the above disclosures Personal Data shall not be used or disclosed for purposes other than the purpose notified to the Company in obtaining such Personal Data. In the event that the Company uses or discloses the exempt personal data, there is no need to request it. The Company will record the use or disclosure in the program as required by law.

6.2 In the event that the Company sends or transfers personal data overseas; The destination country or international organization that receives the personal data. The Company will first verify that the recipient of the data must have adequate personal data protection standards. The Company shall comply with the criteria for providing personal data protection prescribed by law, except:

(1) Compliance with the law;

(2) Obtaining the consent of the Data Subject by notifying the Data Subject; Insufficient personal data protection standards of the destination country or international organization that has received the personal data.

(3) It is necessary for the performance of a contract to which the Data Subject is a party or for the purpose of processing the request of the Data Subject prior to entering into the contract.

(4) It is an act of contract between the Company and another person or juristic person; For the benefit of the data subject.

(5) To prevent or suppress danger to life; The body or health of the Data Subject or another person. When the Data Subject is unable to give consent at that time.

(6) It is necessary for the implementation of missions in the important public interest. In the event of an issue with the adequate personal data protection standards of the destination country or the international organization receiving the personal data.

6.3 The Company, which is headquartered in the Kingdom, has established a policy on the protection of personal data for the purpose of sending or transferring personal data to data controllers or data processors who are located abroad and are affiliated with the same business group or business group for business or joint business operations. If the personal data protection policy has been reviewed and certified by the Office of the Personal Data Protection Commission. Sending or transferring personal data to other countries in accordance with such audited and certified personal data protection policies.

This can be done without conducting a prior inspection under Clause 6.2.

The Company shall appoint employees who are assigned to supervise the collection and use of information specifically to prevent it from being used or disclosed. display or otherwise make visible your Personal Data. In addition to the purpose, subject to the criteria permitted by law, disclosure to the extent that you have given your consent or the scope relevant to this Policy.

Article 7.

The rights of the Data Subject as stipulated by the Personal Data Protection Act B.E. 2562 (2019) are required for the Company to notify you. as follows

7.1 The Data Subject may withdraw his/her consent at any time with the ease of withdrawal of consent. The same is true for the provision of consent, unless there is a restriction on the right to withdraw consent by law or a contract that benefits the Data Subject. The withdrawal of consent will not affect the Collection, use, or disclosure of personal data that the data subject has given consent to.

7.2 The Data Subject has the right to request access to and obtain a copy of his/her Personal Data which is under the Company’s responsibility or to disclose the acquisition of such Personal Data without his/her consent.

7.3 The Data Subject has the right to obtain Personal Data relating to him or her from the Company. If the Company has made the Personal Data in a format that can be read or used in general with an automated tool or device and can use or disclose the Personal Data by automated means, including the following rights:

(1) Request the Company to send or transfer personal data in such form to another data controller when possible by automated means;

(2) Request for personal data that the Company sends or transfers personal data in the form of: directly to another data controller, unless technically it is not possible.

7.4 The Data Subject has the right to object to the collection, use or disclosure of personal information about him or her at any time. as follows

(1) In the case of Personal Data that can be collected without obtaining consent as required by law, unless the Company proves that:

(a) Collection, use or disclosure of such Personal Data The company has demonstrated that the legal grounds are even more important.

(b) The collection, use or disclosure of personal data is for the purpose of establishing a right of claim in accordance with the law; Compliance or exercise of legal claims or the defense of legal claims.

(2) Cases in which personal data is collected, used, or disclosed for purposes related to Direct Marketing

(3) In the case of collection, use, or disclosure of personal data for purposes related to Scientific, historical or statistical research, unless it is necessary for the performance of a mission, in the public interest of the data controller.

7.5 The Data Subject has the right to request the Data Controller to delete or destroy or make the Personal Data non-identifiable information. Personalized. In the following cases:

(1) When personal data is no longer necessary for the purpose of collection; Use or Disclosure of Personal Information

(2) When the Data Subject withdraws his/her consent to the collection, use or disclosure of personal information, the individual and the Company have no legal authority to continue to collect, use or disclose such personal information.

(3) When the Data Subject objects to the collection, use, or disclosure of Personal Data and the Company cannot refuse the request, or it is an objection to the collection, use, or disclosure of Personal Data for the purposes related to the Direct Marketing

(4) When personal data has been unlawfully collected, used, or disclosed;

7.6 The Data Subject has the right to request the Data Controller to suspend the use of the data. Personal information In the following cases:

(1) When the Company is in the process of investigating according to the Data Subject. Request to correct your personal information. It is current, complete, and not misleading. If the data controller does not comply with the request, The Data Controller must record the request of the Data Subject with the reasons in the list as required by law.

(2) When the Personal Data needs to be deleted or destroyed, but the Data Subject requests that the use be suspended.

(3) When personal data is no longer necessary to be retained for the purpose for which it was collected. However, the data subject is required to request that it be retained for the purpose of establishment. Legal Claims The exercise or exercise of legal claims, or the promotion of legal claims.

(4) When the Data Controller is in the process of proving under Clause 7.4 (1) or investigating under Clause 7.4 (3); In order to reject the objection of the Data Subject, in the event that the Data Controller rejects the objection for the reasons specified in Clause 7.4 (1), (a) or (b) or (3), the Data Controller shall record the rejection of the objection together with the reasons in the list.

7.7 The Data Subject requests the Company to take action. Correct personal information to ensure that it is accurate, current, complete, and not misleading. If the Company does not comply with the request, The Company will record the request of the Data Subject with the reasons in the list.

7.8 The Data Subject has the right to lodge a complaint in the event that the Company or the Data Processor, including the Company’s employees or contractors, or the Data Processor, shall lodge a complaint. Violating or failing to comply with the Personal Data Protection Act or the Notice issued under this Act.

8. Supplement or amend the Personal Data Protection Policy

The Company may make changes. Supplement or amend this Personal Data Protection Policy to comply with the law. Regulations and announcements of the government that will be amended in the future and to adjust the Company’s policies to keep up with new technologies and innovations in the Company’s services. The Company will notify the change in the Company’s operations. add Revise the policy to you before proceeding.

What are Cookies?

Cookies are files created by websites you visit that make it easier for you to do things online by saving your browsing data. Remember your website preferences and provide you with relevant content.

10. How do we use cookies?

We will collect website visit data from all visitors through cookies or similar technologies to improve the efficiency of using the Platform and accessing our services through the Internet.

1. To enable you to log in to your account on our platform continuously and securely.
2. To record your usage data on the Platform. Information content, including the platform format you have set up.
3. To study your usage habits and visit the Platform. To develop and improve the website to best meet your needs.
4. To study the behavior of visitors to the platform as a whole and develop the website to be easier, faster, and more efficient.

11. Types of Cookies We Use

Our website contains the following cookies:

1. Platform Cookies: Used to remember your choices or settings on the Platform, as well as to provide you with personalized information such as your account name, language, and platform layout.
2. Advertising Cookies To recognise your past visits, including your usage patterns, to offer you products, services or advertising materials that are relevant and relevant to your interests, and to evaluate the effectiveness of advertising campaigns.
3. Technical cookies are cookies that are necessary for the use of the Platform in order for you to access information thoroughly and securely.
4. Cookies to measure the performance of the Platform It is used to collect information of platform visitors anonymously and to analyze the number and behavior of visitors in order to improve the platform to be more efficient and meet the needs of users.
5. Third-party cookies: These cookies are set by third-party service providers, such as Google Analytics.

12. Cookie settings

In the event that you do not want user information to be collected through cookies. You can delete or reject certain cookies or measurement software through your browser. If you remove cookies, you will be logged out of the website and your saved preferences may be deleted. Here’s how:

• Cookie settings in Chrome
• Cookie settings in Safari and iOS
• Cookie settings in Internet Explorer
• Cookie settings in Firefox

13. How can you contact the Company?

If you have any suggestions or would like to inquire about the details of the collection, use and/or disclosure of personal data, including the application for rights under this policy, please contact us. You can contact the Company through the following channels:

• Phone: 02-152-7780
• Contact: Urban Studio 2021 Co., Ltd
  ., Pa Daet Subdistrict, Mueang Chiang Mai District, Chiang Mai Province

When you agree to this Privacy Policy, you agree to this Privacy Policy. The Company shall assume that you agree that any use of the Company’s services constitutes acceptance of all terms and conditions of use of the Company, and such agreement shall be in full force and effect.