Effective as of 1 June 2022

PRIVACY POLICY

1.    Scope

Privacy of customers (“you” or “your”) is important to Chevrolet Sales (Thailand) Limited (“Chevrolet”, “we,” “us,” or “our”). We want you to know that the information you share with us will be treated with care. This Privacy Policy (“Privacy Policy”) addresses what Personal Data (as defined below) we collect and how we handle the Personal Data shared with us.

 

This Privacy Policy applies to Personal Data we obtain from and about individuals interacting with us, via our websites at www.chevrolet.co.th, call center, social media sites, and other communication channels or through our Authorized Service Outlets. It does not apply to Personal Data we obtain in our capacity as an employer.

 

Please read this Privacy Policy thoroughly to understand how Chevrolet collects, uses, discloses, and/or transfers, including transfer cross-border, your Personal Data. Certain Personal Data is necessary for the provision of our products and services to you. If you do not provide such Personal Data, we may not be able to provide you with our products and services.  This will affect your ability to wholly or partially use or access our products and services. Products and services independently offered by our Authorized Service Outlets is not covered within the scope of this Privacy Policy and may be subject to a separate privacy policy of the respective Authorized Service Outlets. We reserve the right to amend this Privacy Policy at our discretion and at any time. Please revisit this Privacy Policy from time to time for any update of this Privacy Policy. When we make material changes to this Privacy Policy, we will notify you by email or through a notice on our website homepage . Where the law requires us, we may obtain additional consent from you.

2.    Personal Data Collected  
In this Privacy Policy, “Personal Data” means any identified or identifiable information about you. As you interact with us, there may be opportunities that you provide us with your Personal Data.  Additionally, we may collect certain Personal Data about you or your vehicle as further described below.
We may collect Personal Data directly from our current and prospect customers or indirectly from other sources. We may collect Personal Data you provide to us, for instance, on our websites, through product and related events, surveys, emails, social media platforms, or our call centers. In some instances, we may receive your Personal Data from our global affiliates and subsidiaries (collectively as “GM Group”), our Authorized Service Outlets, through a communication system or channel, business partners, other companies, such as companies that provide lists of current owners, if such companies are permitted to share your Personal Data with us pursuant to their privacy policy, or any other publicly available sources. We may collect publicly available information you submit to a blog, a chat room, or a social media platform and we may use your Personal Data for the purposes set out in this Privacy Policy.  We also engage with customers on social media platforms and if you contact us on one of our social media pages, request assistance via social media or otherwise direct us to communicate with you via social media, we may contact you via direct message or use other social media tools to interact with you. In these instances, your interactions with us are governed by this Privacy Policy as well as the privacy policy of the social media platform you use.

Depending on the nature of your service request and context of your interactions with us, the types of Personal Data we collect about you may include, but are not limited to:

•    Personal information: such as title, name, surname, national identification number, passport number, age, date of birth, marital status, occupation, location, voice record, your opinion about our products and service, and signature;

•    Contact information: such as home address, work address, email address, contact number, home phone number, work phone number, facsimile number, mobile phone number, LINE ID, social media ID, and contact hours;

•    Information about your vehicle: such as registration plate number (including temporary red registration plate number), vehicle identification number (VIN), chassis, model, model year, year of manufacture, engine size, torque, horsepower, standard equipment, service history, mileage, oil/battery status, fuel or charging history, electrical system function, gear status, issues or problems about your vehicle, and vehicle performance data;

•    Payment and finance information: such as purchase price, registration fee, payment method (e.g., cash or credit card), credit card information, date of purchase or hire purchase, the hire purchase/financing term and period, interest, down payment, hire purchase company, number of instalments, instalment amount, and the date of service;

•    Service booking information: such as first and last name, telephone number, vehicle identification number, license plate number, preferred province and region to obtain service, and preferred Authorized Service Outlets  location;

•    Demographic information: such as number of children, age of children, number of family members, educational level, and family income;

•    Prospect and marketing profile information: such as prospect customer code, current vehicle, vehicle use, color of the current vehicle, information on a test drive, purchase plan, when you plan to purchase or hire purchase, vehicle in which you're interested, record of follow-up (e.g., showroom visit, follow-up call, customer visit, booked, lost case), source of prospect (e.g., from showroom visit, recommendation, motors show, current customer, social media, or phone call), the reason of inability to close the sale (e.g., you purchase other brand or from other dealer), interest in Chevrolet's activities, whether you would like to be contacted or communication, and channel of communication;

•    Information about your connected devices and how you interact with our products, services, apps and websites: such as mobile phone, computer, or tablet, IP address, browser type, unique device identifier, cookie data, and associated identifying and usage information;

•    Other information: photographs, voice, and videos such as those that you may post for social sharing, relationships you have with us in addition to the purchase and servicing of your vehicle.

If you provide the Personal Data of any third party, such as your family members to us, (e.g. their name, family name, email address, and telephone number), you must ensure that you have the authority to do so and to permit us to use the Personal Data in accordance with this Privacy Policy. You are also responsible for notifying the third party of this Privacy Policy and, if required, obtaining consent from the third party or rely on other legal basis.

In limited circumstances, we may collect, use, disclose, and/or transfer, including transfer cross-border, your Sensitive Data in connection with the provision of our products or services. "Sensitive Data" means Personal Data classified by law as sensitive data.

We may collect, use, disclose, and/or transfer cross-border, the following Sensitive Data:

•    Your race and/or religion as shown on your identification document. 
We will only collect, use, disclose, and/or transfer, including transfer cross-border, Sensitive Data if we have received your explicit consent or as permitted by law.

3.    Purposes and legal bases of collection, use, disclosure, and/or transfer, including transfer cross-border, of your Personal Data
In pursuant with the law, we may collect, use, disclose, and/or transfer, including transfer cross-border, of your Personal Data as set forth in this Privacy Policy based on (1) your consent; (2) pre-contractual and contractual basis, for our initiation or fulfilment of a contract with you; (3) legal obligation, for the fulfilment of our legal obligations (4) legitimate interest, for the purpose of our legitimate interests and the legitimate interests of third parties, to be balanced with your own interest and fundamental rights and freedoms in relation to the protection of your Personal Data; (5) vital interest, preventing or suppressing a danger to a person’s life, body or health; (6) public interest, for the performance of a task carried out in the public interest or for the exercise of official actions and (7) the reason for an establishment and defenses of legal claims, for the following purposes:

 

3.1    The purpose which your consent would be required:

(a)    Marketing and Communications: To provide marketing or re-marketing communications regarding sales, special offers, promotions, campaigns, notices, news, and information about other products and services from Chevrolet, GM Group, and/or business partners via mail, telephone, e-mail, text message, social media and other contact channel, which we cannot rely on other legal grounds;

(b)    Sensitive Data: To the collection, use, disclosure, and/or transfer of your race and religion for verification and authentication purposes and other purposes where consent is required by law;

(c)    Cross-border Transfer: To transfer your Personal Data to a country which may not have an adequate level of data protection, for which consent is required by law.

Where we rely on consent as a legal basis, you have the right to withdraw consent at any time. This can be done so, by contacting our call center at 1734 or by filling out a request at  www.chevrolet.co.th. The withdrawal of consent will not affect the lawfulness of the collection, use and disclosure of your Personal Data and Sensitive Data based on your consent before it was withdrawn.  Withdrawal of consent, to the extent permitted by law, may affect our ability to perform our contractual or legal obligations as well as the provision of our products and services to you.

3.2    The purposes which legal bases can be relied on for collection, use, disclosure, and/or transfer, including transfer cross-border, of your Personal Data

•    Provision of Products and Services: to enter into a contract and to perform our contractual obligation with you; to provide  quotation as requested; to provide services in connection with vehicle purchase; to verify eligibility for  incentive programs; to facilitate and support Chevrolet’s Authorized Service Outlets in  service booking,  vehicle maintenance and repair,  to administer your account(s) and process your payments for products and services; to provide customer and vehicle support and service (such as recall information); to provide you with after-sale services, and help service via our call center; to administer and validate vehicle warranty and provide you with extended warranty where applicable

•    Marketing and Customer Relationship Management:  to communicate with you in relation to the products and services you obtain from us; to maintain customer relationships; to provide vehicle’s information and vehicle’s maintenance records; to provide information and product updates; to provide you with news, information on events and promotions; to send you invitations to participate in our special programs or events; to customize and improve communication content; to respond to your inquiries and fulfil your requests, or to respond to your questions and comments; to send administrative information to you (e.g., changes in terms, conditions and policies);

•    Business Operation, Data Analytics and Development: to comply with our internal record keeping requirements; to analyze and manage our businesses, and conduct market research, surveys, assessments, behavior, statistics and segmentation, consumption trends and patterns for our own analytics purposes; to conduct research, evaluation of use, and troubleshooting purposes; to improve the quality, safety, and security of our products and services; to develop new products and services, including connected, autonomous and car-sharing products and services; to evaluate vehicle performance and safety as described in the vehicle owner manual, to assess customer satisfaction and survey scores;

•    IT Management: to administer and operate our websites, including online registration processes; to autofill data fields on our websites to improve your online experience; to manage communication systems, operation of IT security and IT security audit;

•    Legal and regulatory compliance: to comply with the legal or regulatory requirements which we are subject to under applicable laws, including under foreign law, or to comply with request from governmental agencies or officials;

•    Protection of our rights and our interest: to protect our rights, property, safety or operations or those of any of GM Group, you or others; to pursue available remedies or limit the damages that we may sustain; to enforce agreements or to investigate potential breaches of such agreements; and to establish, exercise or defend our legal rights or for the purposes of legal proceeding;

•    Fraud detection: to verify your identity, and to conduct legal and other regulatory compliance checks (for example, to comply with anti-money laundering regulations, and prevent fraud). This includes to perform internal audits and records, asset management, fraud database, system, and other business controls;

•    Corporate transaction: to transfer your Personal Data to one or more third party in the event of sale, transfer, merger, reorganization, or similar event we may transfer your information to one or more third parties as part of that transaction;

•    Life: To prevent or suppress a danger to a person’s life, body, or health.
Failure to provide certain Personal Data when requested, to the extent permitted by law, may affect our ability to perform our contractual or legal obligations as well as the provision of our products and services to you.

4.    Personal Data Disclosure or Sharing

We may disclose or transfer your Personal Data to third parties who collect, use and disclose Personal Data in accordance with the purposes set forth in this Privacy Policy. We will implement reasonable steps to ensure the protection of your Personal Data, such as confidentiality arrangements, encryption, or appropriate security measures to the extent as required by law. Chevrolet may share Personal Data it collects about you or your vehicle in the following instances:

(a)    GM Group: We may share your Personal Data within global General Motors group, with our subsidiaries and affiliates. In some instances, we may collaborate and utilize shared functions in providing products and services to our customers. Other companies within our GM Group will also rely on consent obtained by us where applicable. More information about GM Group can be found at www.gm.com;
(b)    Authorized Service Outlets: We share and receive Personal Data to and from our Authorized Service Outlet  of your choice or located near you, to serve you with our products and services. You can find out more about our Authorized Service Outlets  at www.chevrolet.co.th;
(c)    Service providers: We may share your Personal Data with our services providers who work on our behalf and who do not have an independent right to use the information to which they have access or that we disclose to them. These service providers includes, but not limit to: (1) IT system, IT support, and data management (e.g., data cleansing) service providers; (2) analytics, research, and survey service providers; (3) marketing, advertising media, and communication agencies; (4) roadside service providers; (5) privilege, campaign and event, organizers; and (6) data storage and cloud service providers;
(d)    Business partners: Your Personal Data may be disclosed to our business partners to conduct business and services related to, repair and maintenance service and marketing activities. This includes our partners from whom we may jointly offer products or services, or whose products or services may be offered to you;

(e)    Third parties required by law or to defend our rights: In certain circumstances, we may be required to disclose or share your Personal Data as required by law or regulation, such as in conjunction with a subpoena, government inquiry, litigation, dispute resolution or similar legal process. These third parties are, for instance, law enforcement agencies (e.g., Department of Land Transport, Revenue Department, Office of The Consumer Protection Board) court, regulator, government authority or other third party where we believe it is necessary to comply with a legal or regulatory obligation. This will also include the disclosure when we believe in good faith that it is necessary to protect our rights, protect your safety or the safety of others, investigate fraud or respond to a law enforcement request;

(f)    External advisors: This includes lawyers, auditors, and other professional advisors who assist in running our business, and defending or bringing any legal claims;

(g)    Assignee of rights and/or obligations: As the case may be, we may disclose your Personal Data in connection with the sale, transfer or financing of a significant part of our business or its assets, including any such activities associated with a bankruptcy proceeding; We will not share or disclose your Personal Data to other third parties for their independent use without your prior consent apart from the purposes listed in this Privacy Policy.

5.    Security Measures

We use appropriate physical, technical, and administrative security safeguards to control access and to protect confidentiality, integrity, and availability of Personal Data concerning you from accidental, unlawful, or unauthorized destruction, loss, access, use, alteration, or disclosure, in accordance with applicable laws.
In particular, we have implemented access control measures which are secured and suitable for our collection, use, and disclosure of Personal Data. We restrict access to Personal Data as well as storage and processing facilities by imposing access rights or permission, user access management to permit access to only authorized personnel, and user responsibilities to prevent unauthorized disclosure, access, knowledge, or unlawful duplication of Personal Data or theft of device used to store and process Personal Data. This also includes methods that enabling the re-examination in relation to access, alteration, erasure, or transfer of Personal Data.
We will from time to time review and update our security measures as necessary or upon development of the concerning technology to ensure effective and appropriate security measures, and in line with minimum legal requirements as prescribed by the relevant supervisory authority.

6.    Cookies/Tracking Technologies
We may use cookies, pixel tags, web beacons and other tracking technologies on our websites, email messages and advertisements to gather information about your visit (such as demographic data, browser type, IP address, pages visited, activities conducted on the page, and the day and time of your visit). Using cookies provides benefits to you, such as allowing you to maintain your contact information on Request a Quote forms between visits, or locating a nearby Authorized Service Outlets. We place pixel tags and web beacons in our emails to measure the effectiveness of our email campaigns by identifying the individuals who open or act upon an email message, when an email message is opened, how many times an email message is forwarded, the type of software, device, operating system and browser used to deliver the email and any URL accessed through our email message. To measure site activity, provide a better user experience, and tailor our marketing communications, we or our service providers or business partners may compile information from the cookies, pixel tags, web beacons or other technologies on our websites. This information may be combined with other information collected online or offline about you, including data provided by third party sources, and may be used or shared for the purposes described in this Privacy Policy. We may also allow third party advertising and personalization partners to use this information to develop personalized content and appropriate advertising based on your visits over time on our web sites and other web sites. This information may also be used to evaluate our online advertising campaigns or to tailor promotions and other marketing messages to you across your devices. At this time, we do not honor “do not track” signals from a web site browser. However, you may refuse or delete cookies. Please refer to your browser Help instructions to learn more about cookies and other technologies and how to manage their use. If you elect to refuse or delete cookies, you will need to repeat this process if you use another computer or change browsers. If you choose to decline cookies, some of the functionality of a website may be impaired.

7.    International Data Transfers
We are a part of GM Group's global business. There are occasions that we may transfer the Personal Data collected from you to our related entities, subsidiaries, affiliates and franchisees located outside of Thailand in the course of providing you with our services or for the purposes set out above. We may also disclose or transfer your Personal Data across border to our service providers and other third parties. These third parties may be  located in foreign countries, such as the United States, the United Kingdom, Australia, and Singapore. Where we transfer your Personal Data overseas, the destination countries may or may not have the same data protection standards as Thailand, as may be prescribed by the Thai supervisory authority. In such case, we will take reasonable steps and measures to ensure that your Personal Data is securely transferred, that the receiving parties have suitable data protection standards in place, or that the transfer is lawful by relying on the derogations as permitted under the law. Where no legal bases or derogation permitted by law can be relied, we will request your consent to disclose or transfer your Personal Data overseas.

8.    How Long We Keep Your Information
We may keep the Personal Data we collect for as long as necessary for the purposes as set out in this Privacy Policy. However, we may have to keep your Personal Data for a longer duration, if required by any applicable law or upon initiation or legal action.  Where legally required, we will anonymize or dispose of the Personal Data we collect when we no longer need it for the uses described above.

9.    Minor's Privacy
Our products, services, and websites do not target or knowingly collect any Personal Data from minors under the age of 20, quasi-incompetent persons and incompetent persons. If you are a minor, quasi-incompetent or incompetent person wishing to engage in relationship with us, you must obtain consent of your parent or guardian prior to contacting us or providing us with your Personal Data.

10.    Authorized Service Outlets      
Chevrolet and our Authorized Service Outlets are separate legal entities with their own privacy practices. For questions about your Authorized Service Outlet's privacy practices including opting out of marketing communications from your Authorized Service Outlet, please contact your Authorized Service Outlet directly. When you buy parts or obtain a service from an Authorized Service Outlet, the Authorized Service Outlet will share your Personal Data with Chevrolet.  Please be aware that each Authorized Service Outlet operates as a separate legal entity and you should read the Authorized Service Outlet’s privacy policy to ensure that you understand its privacy practices and procedures. Additionally, because the Authorized Service Outlet often is the first contact with you, the Authorized Service Outlet can answer any questions you may have about its privacy practices. While Chevrolet encourages its Authorized Service Outlets to ensure full compliance with all applicable privacy laws and has provided information to our Authorized Service Outlet relating to privacy obligations, we are not responsible for Authorized Service Outlets’ compliance with applicable laws. When contacting with the Authorized Service Outlet, you should be provided with information describing the Authorized Service Outlet’s privacy practices and related policies that explain that certain Personal Data that you provide to the Authorized Service Outlet may be shared with Chevrolet or others in accordance with this Privacy Policy.

11.    Your rights as a data subject

Subject to applicable laws and exceptions thereof, you have the following rights:

(a)    Access: You may have the right to access or request a copy of the Personal Data we are collecting, using and disclosing about you.

(b)    Rectification:  You may have the right to have incomplete, inaccurate, misleading, or or not up-to-date Personal Data that we collect, use and disclose about you rectified.

(c)    Data Portability: You may have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to send or transfer such Personal Data to another data controller, where this is (a) Personal Data which you have provided to us, and (b) if we are collecting, using and disclosing such Personal Data on the basis of your consent or to perform a contract with you.
At the present time, we do not have the automated means to provide a copy of your data to other data controllers. However, subject to conditions and exceptions under applicable data protection laws, we may be able to review your request on a specific case-by-case basis and may be able to proceed with your request if all the legal criteria (allowing you to exercise this right under applicable data protection laws) are fully met; provided that your Personal Data that you requested us to port are held by us in the format which is readable or commonly used by ways of automatic machines or tools, and can be used or disclosed by such automatic means to other data controllers. Subject to our further review of your request, if you wish to exercise your data portability right, please contact us at dpo.chevroletthailand@gm.com
(d)    Objection: You may have the right to object to certain collection, use and disclosure of your Personal Data such as objecting to direct marketing.
(e)    Restriction: You may have the right to restrict the use of your Personal Data in certain circumstances.
(f)    Withdraw Consent: For the purposes you have consented to our collecting, using and disclosing of your Personal Data, you have the right to withdraw your consent at any time.
(g)    Deletion: You may have the right to request that we delete, destroy, or de-identity Personal Data that we collect, use and disclose about you, except we are not obligated to do so if we need to retain such data in order to comply with a legal obligation or to establish, exercise, or defend legal claims.
(h)    Lodge a complaint: You may have the right to lodge a complaint to the competent authority where you believe our collection, use and disclosure of your Personal Data is unlawful or noncompliant with applicable data protection law.

For your own privacy and security, we may require you to prove your identity and/or require additional information to fulfill your request. If you are either a Thailand resident who wants to exercise these rights and do not have a national ID, or a Thailand resident who is an English speaker who wants to exercise these rights, please  call 1734. As we operate globally, your Personal Data in our system may be stored in English. Due to technical difficulties, we sometimes may not be able to match you with the Personal Data in our system if you  only provide your name in Thai.

To exercise the rights designated above, you can submit a consumer request to us by either:

Visiting https://privacy-th.ext.gm.com/th/ or

Contacting us at 1734.

12.    How To Contact Us

If you have concerns or questions regarding our privacy practices or this Privacy Policy you may contact us or our Data Protection Officer (DPO) at:

Chevrolet Sales (Thailand) Company Limited

ATTN: Data Protection Officer (DPO)

•    Address: 555 Rasa Tower II 28 th Floor, Phanolyothin Rd., Chatuchak, Bangkok
•    Contact Details:
o    Email address: dpo.chevroletthailand@gm.com