Privacy Policy for LOOK LOOK Platform

Effective Date: 11 Dec 2024

This Privacy Policy (“Policy”) governs the collection, use, disclosure, and transfer of personal data by Jasmine Technology Solution Public Company Limited (hereinafter referred to as “the Company” or “we”) in connection with the use of the LOOK LOOK platform, including its applications and website (collectively referred to as the “Platform”). This Policy is issued in compliance with the Personal Data Protection Act B.E. 2562 (the “PDPA”) and its future amendments.

1. Purpose

The purpose of this Policy is to establish a framework for the protection of personal data collected from users (“you,” “your,” or “Users”) who access or use the Platform. This includes ensuring that all personal data is processed in compliance with applicable laws, utilizing secure measures to safeguard data against unauthorized access, disclosure, alteration, or destruction.

2. Scope

This Policy applies to all personal data collected through the Platform, regardless of the access method (e.g., mobile applications, websites, call centers, social media channels). Any personal data collected from third-party platforms that may be linked to the Platform shall be governed by the privacy policies of those third parties.
For clarity, “Users” include buyers, sellers, merchants, or any individual utilizing or interacting with the Platform, irrespective of whether they have registered an account with the Company.

3. Collection of Personal Data

We collect personal data under lawful bases in the following instances:

1. Direct User Actions: When you register, access, or interact with the Platform, including submitting forms related to services or products.
2. Transaction Activities: When you engage in commercial transactions, provide supporting documents, or participate in surveys, feedback, or inquiries.
3. Automated Collection: Through the use of cookies, log files, or similar technologies.
4. Social Media Integration: When linking your Platform account with external social media accounts or utilizing third-party login services such as Google or Facebook.
5. Voluntary Submission of Third-Party Data: You affirm that you have obtained consent before submitting personal data of others (e.g., family members) for processing.

4. Categories of Personal Data Collected

4.1 For Users

• Identity Data: Username, profile image, password (only for email registrations).
• Contact Data: Email, linked social media accounts, location data (via Explore Places feature).
• Technical Data: Device type, IP address, cookie identifiers, and usage logs.
• Behavioral Data: Preferences, interactions with AI Assistants, feedback or complaints, and usage patterns.

4.2 For Business Partners

• Identity Data: Names of representatives or authorized persons.
• Contact Data: Address, email, and phone number.
• Legal Documentation: Copies of identification documents (e.g., national ID, house registration).

The Company reserves the right to request additional documents to verify the accuracy of data provided.

5. Legal Bases and Purposes of Processing

Personal data may be processed for the following purposes:

1. Service Provision: Facilitating access to and operation of the Platform, including account management and customization features.
2. User Support: Addressing inquiries, complaints, and irregularities related to your account or transactions.
3. Legal and Regulatory Compliance: Ensuring compliance with applicable laws and responding to government inquiries or orders.
4. Identity Verification: Conducting due diligence or Know-Your-Customer (KYC) procedures.
5. Marketing and Analytics: Engaging in promotional activities and analyzing user behavior to improve the Platform.
6. Security and Fraud Prevention: Monitoring and preventing unauthorized or fraudulent activities.
7. AI Optimization: Enhancing the accuracy and relevance of interactions with AI Assistants.

Users retain the right to withdraw consent at any time, with the understanding that this may impact their ability to access certain services.

6. Data Retention

The Company will retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy or as required by applicable laws. For example:

• User Account Data: Deleted within 14 days of account termination, unless required for legal purposes.
• AI Interaction Data: Retained for one year to enhance system performance, after which it will be anonymized or securely destroyed.

7. Data Security

The Company employs appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of personal data. These include access restrictions, encryption, and secure data storage environments. All employees and third-party processors are bound by strict confidentiality obligations.

8. Disclosure of Personal Data

The Company may disclose personal data under the following conditions:

1. Service Providers: To third-party vendors offering logistics, IT, or financial services.
2. Government Authorities: To comply with legal obligations or as required by court orders.
3. Corporate Transactions: In mergers, acquisitions, or asset transfers, provided that adequate safeguards are in place.

All disclosures will be conducted in accordance with applicable laws and this Policy.

9. International Transfers

Personal data may be transferred to jurisdictions outside Thailand. The Company will ensure that such transfers comply with the PDPA by implementing measures that safeguard the data to an adequate standard.

10. User Rights

Under the PDPA, you have the following rights:

1. Right to Withdraw Consent: Withdraw your consent for data processing at any time.
2. Right to Access Data: Request copies of your personal data or details on its source.
3. Right to Rectification: Request corrections to inaccurate or incomplete data.
4. Right to Erasure: Request deletion of data under legal conditions.
5. Right to Restriction: Restrict the processing of your data in specific circumstances.
6. Right to Data Portability: Transfer your data to another entity in a machine-readable format.
7. Right to Object: Object to data processing activities based on specific grounds.
8. Right to Lodge Complaints: File complaints with relevant data protection authorities.

11. Amendments to This Policy

The Company reserves the right to amend this Policy periodically. Users will be notified of material changes through updates posted on the Platform.

12. Contact Information

Data Protection Officer (DPO):
Jasmine Technology Solution Public Company Limited
200 9th Floor, Chaengwattana Road, Pak Kret, Nonthaburi 11120

Email: dpo@jasmine.com

Phone: 02-100-8300 Ext. 5