1. Introduction

MeGenius Company Limited (referred to in this policy as "MeGenius") recognizes the importance of personal data and other information relating to you (collectively, "Data"), so that you can be confident that MeGenius is transparent and accountable in collecting, using or disclosing your Data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) ("Personal Data Protection Law") and other relevant laws. This Personal Data Protection Policy (the "Policy") has therefore been prepared to inform you of the details regarding the collection, use or disclosure (collectively, "processing") of personal data carried out by MeGenius, including its officers and related persons acting on behalf of or in the name of MeGenius, with the following content.

2. Scope of Application of this Policy

This Policy applies to the personal data of persons who have a relationship with MeGenius, both at present and as may arise in the future, whose personal data is processed by MeGenius, its employees, staff or contractors who act on behalf of MeGenius, and including counterparties or third parties who process personal data on behalf of or in the name of MeGenius ("Data Processor"), under various products and services, such as websites, systems, applications, documents or services in other forms that are controlled and supervised by MeGenius (collectively, the "Services").

Persons who have a relationship with MeGenius under the first paragraph include:

1. Individual customers
2. Employees or staff
3. Business partners and service providers who are natural persons
4. Directors, authorized persons, representatives, agents, shareholders, employees, or other persons having a similar relationship, of juristic persons that have a relationship with MeGenius
5. Users of MeGenius's products or services
6. Visitors to or users of the website https://web.aiya.ai/, as well as systems, applications, devices or other communication channels controlled and supervised by MeGenius
7. Other persons whose personal data MeGenius collects, such as job applicants, families of employees or staff, guarantors, beneficiaries of insurance policies, etc.

Items 1) to 6) are collectively referred to as "you"

In addition to this Policy, MeGenius may require privacy notices ("Notices") for MeGenius's products or services, in order to inform data subjects who are users of the services of the personal data being processed, the purposes and the lawful bases for processing, the period for which the personal data is retained, and the rights in personal data that data subjects have in that particular product or service.

In the event of a material conflict between the content of a privacy notice and this Policy, the content of the privacy notice for that service shall prevail.

3. Definitions

MeGenius

means MeGenius Company Limited

Personal data

means information about a natural person which enables the identification of that person, whether directly or indirectly, but not including the information of deceased persons specifically

Sensitive personal data

means personal data as prescribed in Section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), namely data on race, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data which affects the data subject in a similar manner as prescribed by the Personal Data Protection Committee

Processing of personal data

means any operation performed on personal data, such as collecting, recording, copying, organizing, storing, updating, altering, using, retrieving, disclosing, forwarding, disseminating, transferring, combining, erasing, destroying, etc.

Data subject

means a natural person who is the owner of the personal data that MeGenius collects, uses or discloses

Data Controller

means a person or juristic person having the power and duty to make decisions regarding the collection, use or disclosure of personal data

Data Processor

means a person or juristic person who operates in relation to the collection, use or disclosure of personal data pursuant to the orders given by or on behalf of a Data Controller, whereby such person or juristic person is not the Data Controller

4. Sources of Personal Data Collected by MeGenius

MeGenius collects or obtains various types of personal data from the following sources:

1. Personal data that MeGenius collects directly from the data subject through various service channels, such as during application, registration, job application, signing of contracts or documents, completing surveys, or using products, services or other service channels controlled and supervised by MeGenius, or when the data subject communicates with MeGenius at its office or through other contact channels controlled and supervised by MeGenius, etc.
2. Data that MeGenius collects from the data subject's access to and use of websites, products or other services under a contract or in accordance with its mission, such as tracking the behavior of using MeGenius's websites, products or services by means of cookies (Cookies) or from software on the data subject's device, etc.
3. Personal data that MeGenius collects from sources other than the data subject, where such sources have the authority, have a lawful basis, or have obtained the consent of the data subject to disclose the data to MeGenius, such as the linking of digital services of other juristic entities or of the public sector in providing one-stop public-interest services to the data subject, as well as where necessary to provide services under a contract in which personal data may be exchanged with counterparty entities.

In addition, this also covers the case where you provide the personal data of third parties to MeGenius, in which case you are responsible for informing such persons of the details under this Policy or the Notice of the product or service, as the case may be, as well as for obtaining that person's consent where consent is required for disclosure of the data to MeGenius.

Furthermore, if the data subject refuses to provide data that is necessary for MeGenius's services, MeGenius may be unable to provide that service to such data subject, in whole or in part.

5. Lawful Bases for the Collection of Personal Data

MeGenius determines the lawful basis for collecting your personal data as appropriate and according to the context of the service. The lawful bases for collecting personal data that MeGenius uses comprise:

In cases where MeGenius needs to collect your personal data for the performance of a contract, for compliance with legal obligations, or as necessary for entering into a contract, if you refuse to provide the personal data or object to the processing in accordance with the purposes of the activity, MeGenius may be unable to carry out or provide the services you request, in whole or in part.

6. Types of Personal Data Collected by MeGenius

MeGenius may collect or obtain the following data, which may include your personal data, depending on the services you use or the context of your relationship with MeGenius, including other considerations affecting the collection of personal data. The types of data specified below are only a general framework for MeGenius's collection of personal data. Only the data relating to the products or services you use or have a relationship with will apply.

7. Cookies

MeGenius collects and uses cookies, including other similar technologies, on websites under MeGenius's supervision, such as https://web.aiya.ai/, or on your device depending on the service you use, for the purposes of security in providing MeGenius's services and so that you, as a user, receive convenience and a good experience in using MeGenius's services, and this data will be used to improve MeGenius's websites to better meet your needs. You can set or delete the use of cookies yourself from the settings in your web browser (Web Browser).

8. Personal Data of Minors, Incompetent Persons and Quasi-Incompetent Persons

Where MeGenius knows that personal data for which consent is required for collection belongs to a data subject who is a minor, an incompetent person or a quasi-incompetent person, MeGenius will not collect that personal data until it has obtained the consent of the person exercising parental power who is authorized to act on behalf of the minor, or of the guardian, or of the curator, as the case may be, in accordance with the conditions prescribed by law.

Where MeGenius did not know beforehand that the data subject is a minor, an incompetent person or a quasi-incompetent person, and later finds that MeGenius has collected the data of such data subject without having obtained the consent of the person exercising parental power who is authorized to act on behalf of the minor, or of the guardian, or of the curator, as the case may be, MeGenius will proceed to delete and destroy that personal data promptly, if MeGenius has no other lawful basis, apart from consent, for collecting, using or disclosing that data.

9. Purposes of Collecting Personal Data

MeGenius collects your personal data for various purposes, depending on the type of product, service or activity you use, as well as the nature of your relationship with MeGenius, or the considerations in each context. The purposes specified below are only a general framework for MeGenius's use of personal data. Only the purposes relating to the products or services you use or have a relationship with will apply to your data.

1. To provide and manage MeGenius's services, both services under a contract with you and in accordance with MeGenius's business purposes
2. For MeGenius's transactional operations
3. To control, operate, monitor, inspect and manage the services in order to provide convenience and be consistent with your needs
4. To retain and update data relating to you, including documents that refer to you
5. To prepare records of personal data processing activities as required by law
6. To analyze data, including solving problems relating to MeGenius's services
7. To carry out what is necessary for internal organizational management, including recruitment, the selection of directors or holders of various positions, and qualification assessment
8. To prevent, detect, avoid and investigate fraud, security breaches, or prohibited or unlawful acts that may cause damage to both MeGenius and data subjects
9. Identity confirmation, identity verification and data verification when you apply to use MeGenius's services, or contact MeGenius to use services, or exercise rights under the law
10. To improve and develop the quality of products and services so that they are up to date
11. Risk assessment and management
12. To send notifications and confirmations of orders, and to communicate and provide news to you
13. To prepare and deliver relevant and necessary documents or information
14. To confirm identity and to prevent spam or unauthorized or unlawful acts
15. To examine how data subjects access and use MeGenius's services, both overall and individually, and for purposes relating to research and analysis
16. To carry out what is necessary to comply with MeGenius's duties to regulatory authorities, tax authorities, law enforcement, or MeGenius's legal obligations
17. To carry out what is necessary for legitimate interests, whether of MeGenius or of other persons or of other juristic persons connected with MeGenius's operations
18. To prevent or stop a danger to a person's life, body or health, including epidemic monitoring
19. To prepare historical documents for the public interest, for research, or for compiling statistics that MeGenius has been assigned to carry out
20. To comply with laws, announcements and orders that are in effect, or to carry out proceedings relating to legal cases, to act on data in accordance with court warrants, including the exercise of rights relating to your data

10. Categories of Persons to Whom MeGenius Discloses Your Personal Data

Under the purposes specified in Section 9 above, MeGenius may disclose your personal data to the following persons. The categories of recipients specified below are only a general framework for MeGenius's disclosure of personal data. Only the recipients relating to the products or services you use or have a relationship with will apply.

11. Sending or Transferring Personal Data to Foreign Countries

In some cases, MeGenius may need to send or transfer your personal data to foreign countries in order to carry out the purposes of providing services to you, such as to send personal data to a cloud (Cloud) system whose platform or servers (Server) are located abroad (such as Singapore or the United States, etc.), in order to support information technology systems located outside Thailand, depending on MeGenius's services that you use or are involved with, on an activity-by-activity basis.

However, at the time this Policy was prepared, the Personal Data Protection Committee had not yet announced a list of destination countries with adequate personal data protection standards. Therefore, when MeGenius needs to send or transfer your personal data to a destination country, MeGenius will take steps to ensure that the personal data sent or transferred has adequate personal data protection measures in accordance with international standards, or will proceed in accordance with the conditions that allow such data to be sent or transferred lawfully, namely:

• It is compliance with a law that requires MeGenius to send or transfer personal data abroad
• You have been informed and your consent has been obtained, in the case where the destination country has inadequate personal data protection standards, in accordance with the list of countries announced by the Personal Data Protection Committee
• It is necessary for the performance of a contract to which you are a party with MeGenius, or to act upon your request before entering into that contract
• It is acting in accordance with a contract between MeGenius and another person or juristic person, for your benefit
• To prevent or suppress a danger to the life, body or health of you or of other persons, when you are unable to give consent at that time
• It is necessary to carry out a mission in the substantial public interest

12. Period of Retention of Your Personal Data

MeGenius will retain your personal data only for as long as that data remains necessary for the purposes of the data collection, in accordance with the details specified in the Policy, Notices or relevant laws, or where MeGenius needs to retain that data for the legitimate interests of the company, such as to serve as data for proving the provision of services, or retention for the entire limitation period of civil cases (10 years) or criminal cases, etc. However, such retention will be limited to necessary data only, and the data will be retained in accordance with the standards specified in the Policy, Notices or relevant laws.

When the period has ended and your personal data is no longer necessary for those purposes, MeGenius will delete or destroy your personal data, or make your personal data no longer able to identify you, in the form and according to the personal data deletion and destruction standards that the committee or the law will announce, or in accordance with international standards.

In the event of a dispute, exercise of rights or legal case relating to your personal data, MeGenius reserves the right to continue retaining that data until a final order or judgment has been issued in that dispute, which may exceed the period that could normally be expected or that is prescribed by law.

13. Services by Third Parties or Sub-contractors

MeGenius may assign or contract third parties (Data Processors) to process personal data on behalf of or in the name of MeGenius. Such third parties may offer services of various kinds, such as acting as a host (Hosting), undertaking sub-contracted services (Outsourcing), or acting as a cloud service provider (Cloud computing service/provider), or work in the nature of hiring of work in other forms.

In assigning a third party to process personal data as a Data Processor, MeGenius will provide an agreement specifying the rights and duties of MeGenius as the Data Controller and of the person whom MeGenius assigns as the Data Processor, including specifying the details of the types of personal data that MeGenius assigns for processing, as well as the purposes, the scope of processing of personal data and other related agreements. The Data Processor has the duty to process personal data only within the scope specified in the agreement and in accordance with MeGenius's instructions, and cannot process it for any other purpose.

In the event that the Data Processor assigns a sub-contractor (sub-processor) to process personal data on behalf of or in the name of the Data Processor, MeGenius will direct the Data Processor to provide an agreement document between the Data Processor and the sub-processor, in a form and to a standard no lower than the agreement between MeGenius and the Data Processor.

14. Method for Requesting Deletion of Personal Data

You can request deletion of your personal data by sending a request by email to dpo@aiya.ai specifying the following details:

1. Your first name and surname
2. The data you want deleted, for example, you want all data relating to you to be deleted
3. The reason for requesting deletion of the data (if any), for example, you are requesting deletion because you no longer want MeGenius to provide services to you, etc.

MeGenius will review your request and delete such data from the system within no more than 30 days from the date the request is received (or, if your data is large in volume, MeGenius will inform you within 30 days from the date the request is received how long it will take to complete the deletion of the data).

Deletion of data will be in accordance with the standards and requirements specified in the privacy policy or relevant laws. If your personal data is still necessary to MeGenius, and MeGenius still has the right to retain the data as permitted by law, or for the purpose of establishing rights or preventing disputes, MeGenius reserves the right to retain such data until such data is no longer necessary to MeGenius, or MeGenius no longer has the right to retain the data as prescribed by law.

15. Security of Personal Data

MeGenius has measures to protect personal data by restricting access rights to personal data so that it can be accessed only by specific employees or persons with authority and duties, or who are assigned and need to use such data in accordance with the purposes already notified to the data subject. Such persons must strictly adhere to and comply with MeGenius's personal data protection measures, and have a duty to maintain the confidentiality of personal data they learn of in the course of performing their authorized duties. MeGenius has data security measures, both organizational and technical, that meet international standards and are in accordance with what the Personal Data Protection Committee announces.

In addition, when MeGenius sends, transfers or discloses personal data to third parties, whether for the provision of services in accordance with business purposes, under a contract, or under an agreement in other forms, MeGenius will specify appropriate personal data security and confidentiality measures in accordance with what the law requires, in order to ensure that the personal data MeGenius collects is secure at all times.

16. Data Protection Officer

MeGenius has appointed a Data Protection Officer (DPO) to inspect, supervise and advise on the collection, use or disclosure of personal data, including coordinating and cooperating with the Office of the Personal Data Protection Committee, in order to comply with the Personal Data Protection Act B.E. 2562 (2019) (PDPA).

17. Your Rights under the Personal Data Protection Act B.E. 2562 (2019) (PDPA)

As a data subject, you have rights under the Personal Data Protection Law, subject to the conditions and exceptions prescribed by law, as follows:

1. The right to access and obtain a copy of your personal data collected by MeGenius, including to request disclosure of how MeGenius obtained such data where you did not give consent.
2. The right to receive your personal data in a format that is readable or commonly used by automatic tools or devices, and to request that such data be sent or transferred to another data controller.
3. The right to object to the collection, use or disclosure of your personal data.
4. The right to request the erasure or destruction of your personal data, or to make it data that cannot identify you (see Section 14 for how to request deletion).
5. The right to request the temporary suspension of the use of your personal data.
6. The right to request that your personal data be rectified so that it is accurate, up to date, complete and not misleading.
7. The right to withdraw consent you have given, where the processing relies on your consent. Withdrawal of consent does not affect processing carried out before the withdrawal.
8. The right to lodge a complaint with the Personal Data Protection Committee or the competent supervisory authority, as described in Section 19.

You may exercise these rights by sending a request by email to dpo@aiya.ai, stating your name, the channel through which you contacted or used the services, and the right you wish to exercise. MeGenius may ask for additional information to verify your identity before proceeding, and will inform you of the outcome of your request within 30 days of receiving a complete request. MeGenius may refuse a request where the law requires or permits it to do so, in which case it will tell you the reason.

18. Penalties for Non-compliance with the Personal Data Protection Policy

Non-compliance with the Policy may constitute an offense and result in disciplinary action under MeGenius's rules (for employees or staff of MeGenius) or under the personal data processing agreement (for Data Processors), as the case may be and depending on the relationship you have with MeGenius, and may be subject to penalties as prescribed by the Personal Data Protection Act B.E. 2562 (2019) (PDPA), as well as subordinate legislation, rules, regulations and orders relating thereto.

19. Complaints to Regulatory Authorities

If you find that MeGenius has not complied with the Personal Data Protection Law, you have the right to lodge a complaint with the Personal Data Protection Committee or with a regulatory authority appointed by the Personal Data Protection Committee or under the law. However, before making such a complaint, MeGenius asks that you please contact MeGenius, so that MeGenius has the opportunity to learn the facts and clarify the various issues, including addressing your concerns first at the earliest opportunity.

20. Revision of the Personal Data Protection Policy

MeGenius may consider improving, amending or changing this Policy as it sees fit, and will notify you through the website https://web.aiya.ai/ with the effective date of each amended version indicated. However, MeGenius recommends that you regularly check to learn of the new version of the Policy, through the application or the activity-specific channels that MeGenius operates, especially before you disclose personal data to MeGenius.

Your access to and use of MeGenius's products or services after the new Policy takes effect is deemed an acknowledgement of the terms of the new Policy. Please stop using them if you do not agree with the details of this Policy, and please contact MeGenius so that the facts can be clarified further.

21. Contact Us

If you have any questions, suggestions or concerns about MeGenius's collection, use and disclosure of personal data, or about this Policy, or you wish to exercise your rights under the Personal Data Protection Law, you can contact and inquire at: