Privacy Notice for Customers
Last updated: 2026
Quantum Vault Co., Ltd. (the "Company") places the utmost importance on the protection of our customers' personal data and privacy and is committed to protecting information about you which directly or indirectly identifies you ("Personal Data") and to complying with the Personal Data Protection Act B.E. 2562 (2019) (including any amendments thereto) (the "PDPA"), as well as international standards on personal data protection, in order to be consistent with the principles of good corporate governance.
This Privacy Notice describes the following in detail:
- what types of Personal Data the Company collects, including the data you provide to the Company about yourself as a customer of the Company, authorised persons, guests, or a person related to your business, which may include your employees, staff, directors, representatives, or shareholders where you are a juristic person ("you");
- how the Company uses your Personal Data;
- to whom and for what purposes the Company discloses your Personal Data;
- how long the Company retains your Personal Data; and
- what rights you have in relation to your Personal Data and how the law protects you.
Collection of Personal Data
The Company collects various types of Personal Data from a variety of sources, including but not limited to:
- when you apply for the Company's private vault lease services for storing property and documents, use the vault, private vaults, or any other services of the Company, or register to access the Company's premises;
- when you contact the Company whether by telephone, website, email, or any other means;
- when you visit the Company's website or use the Company's mobile application, including cookies and other internet software used to collect Personal Data (please see the Company's Cookies Policy for more details);
- when the Company receives your Personal Data from third parties, such as external service providers, business partners, agencies, organisations, or any person having a contractual relationship with the Company, your guardian or curator, the juristic person for which you work (where the Company's customer is a juristic person), government officers or other state agencies, etc.; and
- publicly available information, such as information from the mass media.
In some cases, the Company may collect Personal Data from additional online and offline sources (if necessary) and may combine such information with the Personal Data it collects about you under this Privacy Notice.
The types of Personal Data that the Company collects in accordance with applicable laws include, but are not limited to, the following:
- Identity information: name, surname, gender, date of birth, signature, national identification card number, passport number, other identification numbers and personal information appearing on government issued identification documents, driving licence, nationality, photograph on identification card, photograph on passport, information relating to death, disappearance, status as an incompetent or quasi-incompetent person, including information relating to your heirs, estate administrators, guardians or curators;
- Contact information: your address, telephone number and email address;
- Financial information: billing address, bank account information, credit or debit card number, cardholder name or bank account details;
- Transaction and service usage information: private vault number leased by you, lease period, dates and times of entry to and exit from the Company's premises, and access to the vault and private vaults;
- Electronic data: IP address, cookies, activity logs, identifiers, online identifiers, unique device identifiers, and personal identification numbers (PIN codes) used to access the vault room;
- Sensitive Personal Data: your facial recognition data and fingerprint recognition data.
Use of Personal Data
The Company will collect, use, and/or disclose your Personal Data only where it has a legal basis to do so as specified under the POPA. These legal bases include:
- In order to fulfil the contract we have entered into with you (contractual basis), i.e., where the Company needs to use your Personal Data to provide services to you pursuant to an agreement or to take pre-contractual steps;
- In order to comply with a legal obligation (legal obligation basis), i.e., where the Company needs to collect, use and/or disclose your Personal Data in order to comply with applicable laws or legal obligations;
- Where it is for our legitimate interests (legitimate interests basis), i.e., the Company collects, uses, and/or discloses your Personal Data for its legitimate interests as permitted by law, except where such interests are overridden by your fundamental rights; and/or
- Where you have given your consent (consent basis), i.e. you consent to the Company to collect, use and/or disclose your Personal Data for one or more specific purposes.
The purposes and legal bases on which the Company collects, uses, and/or discloses your Personal Data include the following:
| Purposes of collecting, using, and/or disclosing Personal Data |
Legal basis for collecting, using, and/or disclosing Personal Data |
| Provision of services |
- to register you for the lease of private vault and verify your identity when you use the Company's services and/or contact the Company
|
|
- to provide private vault lease services for storing property and documents, and to provide other services and benefits to you
|
- to communicate with you via email, telephone, text message, post, or any other means about the Company's services or to provide information and notices that are not related to marketing activities, such as notifications of changes to the Company's operating hours
|
- to collect, use and/or disclose sensitive Personal Data, namely facial recognition data and fingerprint recognition data, for the purpose of accessing the Company's premises, vault, and private vaults
|
|
| Compliance with legal obligations |
- to comply with laws and regulations applicable to the Company
- to perform the duties of the data controller under the law
- to cooperate and communicate with government officers or other state agencies and to comply with lawful orders of such agencies, as necessary.
|
|
| Customer support |
- to act on your instructions or requests, such as request to amend information in customer information forms or requests for documents or information from the Company
- to respond to your enquiries and to record your communications, comments, and/or complaints
- to verify ownership or rights in relation to property stored in private vaults in cases where the Company cannot contact you to remove property stored in the relevant vault
|
|
- to develop and improve the Company's services
- to respond to questions and record your contact, comments and/or reports
|
|
- to develop and improve the Company's services
- to respond to questions and record your contact, comments and/or reports
|
|
| Security and risk management |
- to investigate, report and prevent criminal offences
|
|
- to manage risks and perform internal audits
- to prevent or suppress danger to the life, body, or health of individuals
- to prevent crime and maintain security within the Company's premises, vault, private vaults, and property stored in the private vaults (for example, by using closed circuit television (CCTV) which may record your image, movements, or voice)
|
|
| Marketing and the Company's legitimate interests |
- to send personalised marketing messages to you
|
|
- to communicate with you via email, telephone, text message, or other channels about the Company's services that you may be interested in
- to develop and proceed with marketing activities of the Company or its group in Thailand
- to study and analyse your use of the services and to further promote the services, and for the benefit of providing integrated and efficient customer services
- to test, research, analyse and develop new products or services
- for liquidation, corporate restructuring affecting the Company, sale, transfer, merger, or other disposal of all or part of the Company's shares or assets, including any transferor assignment of rights or obligations which the Company has under contracts between the Company and you
|
|
Where You are Unable to Provide Personal Data to the Company
Where the Company is required to collect your Personal Data by law or under the terms of an agreement between you and the Company, and you do not provide your Personal Data to the Company, the Company may not be able to perform its obligations to you or the obligation under the agreement to be entered with you as intended (for example, to register you as a customer of the private vault lease services). In such cases, the Company may have to refuse to provide the relevant services, and the Company will inform you of such situation at the time the Company collects your Personal Data.
If You are a Minor
The Company is pleased to provide services to and welcome all customers. However, if you have not yet reached the age of legal capacity, you are not able to enter into a private vault lease agreement for storing property and documents with the Company or be a permitted person. The Company does not intend to collect, use, and/or disclose your Personal Data in any way.
Disclosure of Personal Data
The Company may disclose your Personal Data to other persons if permitted by law, including in the following circumstances:
- where it is necessary for the performance of contractual obligations relating to the services (for example, to maintain security, or to comply with a request to deduct from your bank account or charge your credit card for payment of private vault lease payment and other fees);
- where the Company has a legal obligation to do so (if any), for example, for fraud prevention or anti-money laundering purposes;
- for the establishment of legal claims, the conduct of legal actions, the exercise of legal rights, or the defence against legal claims;
- where it is carried out for the Company's legitimate interests (for example, to verify customer identity, to verify ownership or rights in relation to property in private vaults, for due diligence, or liquidation, corporate restructuring affecting the Company, sale, transfer, merger or other disposal of all or part of the Company's shares or assets, including any transfer or assignment of rights or obligations which the Company has under contracts between the Company and you); and/or
- where the Company requests, and you give, your consent to such disclosure.
The Company may disclose your Personal Data for the above purposes to the following persons:
- other group companies of the Company, and subcontractors, agents or service providers that work for, or provide services to, the Company or other group companies of the Company, including the employees, subcontractors, service providers, directors, and officers of such service providers;
- persons who are assigned to manage assets or any benefits, liquidators, receivers, or legal execution officers of the Company;
- the Company's agents, banks and card issuers for deducting bank accounts or charging credit cards, payment system providers, and the Company's business partners;
- any person or juristic person involved in liquidation, corporate restructuring affecting the Company, sale, transfer, merger or other disposal of all or part of the Company's shares or assets, including any transfer or assignment of rights or obligations which the Company has under contracts between the Company and you;
- law enforcement authorities, government agencies, courts, court proceedings, dispute resolution bodies, auditors, and any persons appointed or requested by regulators of the Company to conduct investigations into the Company's operations;
- any other persons involved in any dispute, including disputes relating to transactions;
- any person to whom the Company is instructed by you to disclose your Personal Data; and/or
- other relevant persons for any marketing purposes.
Except as provided in this Privacy Notice, the Company will not use Personal Data for purposes other than those specified in this Privacy Notice. If the Company intends to collect, use and/or disclose additional information which is not specified in this Privacy Notice, the Company will inform you and obtain your consent before such collection, use and/or disclosure. You have the right to consent or refuse the collection, use and/or disclosure of your Personal Data, except where the law permits the Company to proceed without your consent.
Cross-border Transfers of Personal Data
Your Personal Data may be transferred to, and collected and/or used in, other countries.
Where the destination country does not have adequate personal data protection measures as prescribed by the Personal Data Protection Committee, the Company will ensure that such transfer is subject to appropriate personal data protection safeguards and that the transfer is lawful. For example, the Company may enter into a contract with the overseas data recipient based on standard contractual clauses for the cross-border transfer of Personal Data.
The Company may need to send or transfer Personal Data for the performance of an agreement between you and the Company, for compliance with legal requirements, for the protection of the public interest and/or for the Company's legitimate interests. However, the laws of some countries may require the Company to disclose certain categories of Personal Data (for example, disclosure to tax authorities). In such cases, the Company will disclose Personal Data only to persons who have the right to see or access such information.
Retention of Personal Data
The Company will retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected. The Company will retain your Personal Data for as long as necessary under the law, generally not exceeding 10 years after you cease to be a customer, which is the maximum prescription period under civil law. This is for the benefit of the Company in establishing legal claims, exercising legal rights, or raising defenses against legal claims that may arise during such period. If there is a valid legal reason to do so, the Company may retain your Personal Data for longer than 10 years. Where the Company no longer needs to retain your Personal Data, the Company will destroy, delete, or anonymise it (so that it can no longer be associated with you and no longer constitutes Personal Data.) prior to the 10-year period.
Your Rights as a Data Subject
In certain circumstances, you have the rights in relation to your Personal Data under the POPA. The Company respects your rights and will promptly comply with applicable laws, rules and regulations relating to the collection, use and/or disclosure of your Personal Data.
Your rights are set out per below:
- Right to withdraw consent: Where the Company collects, uses, and/or discloses your Personal Data on the basis of your consent, you have the right to withdraw your consent to such collection, use and/or disclosure at any time. However, the Company may continue to collect, use, and/or disclose your Personal Data if the Company has another legal basis for doing so.
- Right of access and to obtain a copy: You have the right to access the Personal Data concerning you that is under the Company's responsibility, or to request that the Company disclose how it obtained your Personal Data in the absence of your consent. You have the right to request a copy of the record of the processing of your Personal Data. If you request additional copies, the Company may charge a reasonable fee based on the administrative costs as permitted by law.
- Right to rectification: You have the right to request the rectification of inaccurate or incomplete Personal Data so that it is accurate, up to date, complete and not misleading.
- Right to deletion or destruction: You have the right to request that the Company delete, destroy or anonymise your Personal Data to the extent permitted by law. This right does not necessarily cover all of your Personal Data. The Company will consider your request carefully in order to comply with applicable legal requirements relating to the processing of your Personal Data.
- Right to object collection, use and/or disclosure: You have the right to object to the collection, use or disclosure of your Personal Data on grounds relating to your particular situation. Under the provisions of law, if you object to the collection, use or disclosure of your Personal Data, the Company may continue to collect, use or disclose your Personal Data only where the Company can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or where such collection, use or disclosure is necessary for the establishment, exercise or defense of legal claims, or for scientific, historical or statistical research, as the case may be.
- Right to restriction of use: You have the right to request that the Company suspend or restrict the collection, use and/or disclosure of your Personal Data on a temporary basis. For example, this may apply where you ask the Company to rectify your Personal Data or where you request that the Company verify its grounds or legal basis for collecting, using, and/or disclosing your Personal Data.
- Right to data portability: You have the right to request a copy of your Personal Data that you have provided to the Company, except where this cannot be done for technical reasons. You also have the right to request that the Company transmit or transfer such Personal Data, in such format where this is technically feasible, directly to another data controller by automated means where this can be done.
- Right to lodge a complaint: You have the right to lodge a complaint with the regulatory authority responsible for personal data protection if you consider that the Company, its employees, or its service providers have breached or failed to comply with the Personal Data Protection Act B.E. 2562 (2019) or any notifications issued under such Act.
You may exercise any of your rights at any time by contacting the Company through the contact details set out in Part 8 (Contacting the Company) below (or in exercising of any other rights). However, the Company may refuse to act on your request in certain circumstances.
The Company may need to request certain information from you to verify your identity and to confirm your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that your Personal Data is not disclosed to a person who has no right to access it. The Company may also contact you to request further information relating to your request in order to respond to your request more promptly.
Protection of Your Personal Data
The Company takes appropriate measures to implement organisational, technical, and administrative security safeguards to protect against the loss, misuse, unauthorised access, disclosure, or alteration of Personal Data.
Changes to this Privacy Notice
The Company will review this Privacy Notice from time to time. Accordingly, this Privacy Notice may be amended or updated whereby the Company will inform you of any changes so that you remain adequately informed.
Contacting the Company
If you have any questions about the protection of your Personal Data, or if you wish to exercise any of your rights, please contact the Company at:
Contact Address:
Quantum Vault Co., Ltd.
989 Rama 3 Road, Bang Phongphang Sub-district, Yannawa District Bangkok 10120
Contact Details:
+662-294-8888
email: contact@quantumvault.co.th
website: quantumvault.co.th
Privacy
