Objectives of processing personal data: the Company needs to collect your personal data when you log in, register, and or use All Online, All member and/or from CP ALL PCL or subsidiaries in the Group, in order to use the website and/or application, as well as using the Company’s services within application, such as All Online, to name a few. This helps identify and verify your identity, providing service and product as committed in the contract, granting privileges, advertisement, marketing, and presenting service and products overall, or individually, per your interests. This includes quality of product and service, service and product quality improvement, analyses, researches, market surveys, tax invoice issuance, service improvement, resolving grievance, report and statistic development, risk management, safety measures ensuring the information is protected. There may also be personal data disclosure to data processors, business partners, or per demanded by laws, as follows.

Lawful bases of processing personal data: the Company processes your personal information according to the following basis:

Consent: the Company shall request for your consent prior to collecting and/or use your personal data to conduct profiling, analyzing your behaviors and interests in designing or developing products, and/or services, as well as personalized advertising fitting your interests. This includes the presentation and/or recommendation regarding product and/or services, direct marketing, such as emails, SMS, and/or disclosure of your personal data to companies in the Group or business partners. This is for those with the same activities and objectives as the Company’s, or activities and objectives as disclosed. The objectives behind the use of collected data is according to the opt-in consent stated. If you wish to make changes regarding the consent, you may make the modification yourself on the website, Call Center, or through contact channels as appeared in this document, to express your wish per Article 4.

Contract: Once you register for a new account or access the website and/or application of the Company. You must provide your own personal data to identify and validate your identity, to enable conduct according to the sell contract, to provide service accordingly, to deliver products and services as committed, or to coordinate with you for post-sell service support. This includes modifying and improving services upon your feedback notified via various channels of the Company, the refunds upon product returning, effectiveness improvement for products and services, management and marketing of products, services, privileges, sell promotion activities, researches, analyses and market surveys, statistical information development, presenting novel product and service to you in an overview. If you do not consent for your personal data to be used according to the objectives within the contract, the Company would not be able to service you.

Legitimate Interest: The Company may offer products, promotions, or privileges as normal, without analyzing or delivering customized privileges to you. The Company may process the data, conduct research, or statistical work per the Company’s objectives. This enables convenience in tax invoice issuance for you upon your next purchase, reporting on internal corporate performance, improving the Company’s service quality, in order to manage the Company’s performance risk, corruption prevention, setting safety measures for both yours and the Company’s asset.

Legal Obligation: The Company may need to share your personal data to officers and governmental agencies with lawful authorities to request for information held by the Company. This includes Office of the Consumer Protection Board of Thailand, Royal Thai Police, Prosecutor’s Office, Courts, to name a few. In case of tax invoice issuance, the Company must collect your personal data information according to relevant code of revenue, laws and notices, such as measure 86/4 code of revenue, a notice from Revenue Department’s regarding VAT (No. 199), to name a few. The Company must delivery this information to the Revenue Department. If you do not provide the personal information, the Company would not be able to issue a full tax invoice for you. However, you will always receive the abbreviated tax invoice from the Company for the product and service purchase.

Personal data that the company will collect / How long the information is kept on corporate files

- Website: full name, date of birth, gender, mobile numbers, address, emails, list and history of product-service purchase, chat records whether audio (phones) or texts (websites, letters) upon your contact with the Company, copies of book banks/bank accounts (for case of refund in cash) throughout the duration you maintain the user account. The Company shall keep that information for no more than 90 days since the day the account was canceled (the user account will be cancelled within 30 days after your notification).

- Application: names, date of birth, gender, mobile numbers, address via Geolocation/Location Data, list and history of product and service purchases, conversation records whether as audio (phone), or text (website, letters) when you contact the Company. This will be so throughout the entire duration you maintain your user account. The Company shall keep the information for no more than 90 days since the date your account is cancelled (user account will be canceled within 30 days since your notification).

- Tax invoice issue: full name, address, tax id (national ID). The Company shall keep the information for no more than 6 years, since the year of tax invoice issuance.

- Notably, once the initial duration has passed, the Company will delete or anonymized the information.

You have the right to request your data be deleted, destroyed or anonymized, in cases as follows.

- When there is no longer the need for your personal information to be collected, used, or disclosed the personal information as informed.

- When you retract your consent and the Company no longer have the legal authority to collect, use, or disclose that personal information.

- When you refute the collection, usage, or disclosure of personal information under the objective the Company referred to, for legitimate interests and the Company’s direct marketing, In such cases where the Company cannot decline.

- When personal information collected, used, or disclosed by the Company was done unlawfully.

- When you request to delete or cancel all your accounts, or cancel accounts registered via third-party accounts, such as Facebook, Apple, Google. You can get in touch to delete or cancel your account at customer relation center or call 02-780-7666. The Company shall delete your accounts within 30 days after your request, and delete your personal data 90 days after your account got cancelled.

Should there be any grievance regarding personal data, please contact the Data Protection Officer at this channel.

Data Protection Officer (DPO) No.313, C.P. Tower, 24th Floor, Silom Road, Khwaeng Silom, Khet Bangrak, Bangkok 10500

Email Address: privacy@cpall.co.th

24 Shopping Co., Ltd. 58/28 Moo 2, The Tara Building, 12th – 12A Floor, Chaengwattana Road, Tumbol Bangtalad, Aumphur Pak Kret, Nonthaburi 11120

Hot Line: 02-780-7666 (available 24 hours)

If you perceived that your personal data processing is not being conducted in accordance with the Personal Data Protection Act 2019, you have the right to put in request to Personal Data Protection Committee Office.

This privacy notice is effective on the same date with the Personal Data Protection Act 2019, since 1th June 2022 onwards.