Privacy Notice for Customers

RICOH (Thailand) Limited and RICOH Services (Thailand) Limited (“Company”) place great importance on the protection of personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019). Accordingly, this Privacy Notice has been prepared to inform you of the details relating to the collection, use, and disclosure of your personal data, as set out below.

1. Scope of Application of this Privacy Notice

1.1 Natural persons, such as customers of the Company, including service users, prospective customers, former customers, and current customers.

1.2 Natural persons related to corporate customers, including employees, personnel, officers, representatives, shareholders, authorized persons, directors, executives, agents, contact persons, and any other individuals associated with the Company’s corporate customers.

1.3 Any natural persons from whom the Company receives personal data, such as individuals who contact the Company through various channels, emergency contacts, spouses, or any other third parties related to the customer.

All of the above individuals are collectively referred to in this Privacy Notice as “you” or “data subjects”. These individuals are considered persons related to the offering of the Company’s products or services, including service users, participants in activities or campaigns, authorized representatives, or persons exercising parental authority or legal guardianship.

2. Personal Data Processed by the Company

The Company processes various types of personal data, either directly obtained from you or indirectly from other sources. Such personal data may be categorized as follows:

In the event that the Company receives a copy of your national identification card or any other document for the purpose of identity verification prior to entering into a legal relationship and/or conducting any transaction with the Company, such information may include religion or other sensitive personal data. The Company has no policy to collect such data from you, except where the Company has obtained your consent or has other lawful bases for processing.

  In this regard, where the Company receives religion or other sensitive personal data appearing in identity verification documents, and you have not provided consent or have not redacted such data, or where the Company has no lawful basis for processing, you acknowledge and understand that the Company will protect your personal data by implementing appropriate measures, such as masking or striking through, in accordance with personal data protection principles.

  The Company may receive personal data of third parties related to you, which you provide to the Company, such as emergency contact persons. The Company will use such data for emergency contact purposes. Please inform such third parties of this Privacy Notice and obtain their consent where necessary, unless an exemption under applicable law applies and the Company is not required to obtain such consent.

  The Company will not collect personal data of minors (persons who have not reached legal age, i.e., under 20 years of age, or who have not attained legal capacity by marriage or other means as prescribed by law), quasi-incompetent persons, or incompetent persons without obtaining consent from a person exercising parental authority, a guardian, or a curator, as applicable, or without relying on any other lawful basis. In the event that the Company becomes aware that it has collected personal data from such individuals without consent and without any other lawful basis, the Company will delete such personal data immediately upon becoming aware.

3. Sources of Personal Data

The Company collects your personal data through the following processes:

  3.1 Personal data provided directly by you to the Company, such as information appearing in requests for quotations, product orders, requests for product demonstrations (Demo), information used for registration for after-sales services, problem reporting, installation requests or service requests from the Company, supporting documents such as company affidavits, copies of national identification cards, repair/maintenance records, or other service confirmation documents; information arising from your contact with the Company via telephone, email, or communications with the sales team/service team, including audio or visual data from online communication systems; and information provided by you when completing Customer Satisfaction Surveys or providing feedback or suggestions.

  3.2 Personal data collected automatically when you access the Company’s services through the Company’s systems or visit the Company’s website via electronic devices, such as mobile phones or computers. The Company may collect personal data through the use of technologies known as “cookies” or other similar technologies.

  3.3 Personal data obtained from external sources or reliable public sources, such as the Department of Provincial Administration, the Department of Business Development, commercial data sources, websites, applications, social media sources, data providers, and relevant agencies, companies, associations, or federations related to your services.

  3.4 Personal data obtained from your participation in activities with the Company, such as marketing activities, contests, lucky draws, events, or competitions organized by or on behalf of the Company, its business partners and/or affiliates, or activities conducted by parties authorized or appointed by the Company.

4. Purposes of Collection, Use, and Disclosure of Personal Data

The purposes for which the Company processes your personal data based on your consent include, for example, marketing and communications, service usage, the provision of special offers, promotions, discounts, privileges, notifications, and the provision of news and information regarding the Company’s services, including those of its affiliates and/or business partners, where the Company cannot rely on any other lawful basis.

The purposes for which the Company processes your personal data based on other lawful bases are as follows:

(1) Basis for archiving or historical documentation or public interest or research or statistic.
(2) Contractual basis for entering into, initiating, or performing a contract with you.
(3) Legal obligation basis for compliance with the Company’s legal obligations.
(4) Legitimate interests of the Company and third parties.
(5) Vital interests for preventing or suppressing danger to life, body, or health, and/or.
(6) Public interest for carrying out tasks in the public interest or exercising official authority.

The Company relies on the aforementioned lawful bases or other lawful bases as permitted under applicable personal data protection laws, as the case may be, for example:

(1) For preventing or suppressing danger to a person’s life, body, or health where the data subject is unable to give consent.
(2) For carrying out activities of foundations or non-profit organizations in accordance with the conditions prescribed by law.
(3) Where the data has been disclosed to the public with the explicit consent of the data subject.
(4) Where it is necessary in relation to legal claims.
(5) Where it is necessary for compliance with the law to achieve the following purposes:

(a) preventive medicine or occupational medicine
(b) public health interests
(c) labor protection and social protection
(d) research
(e) significant public interest

The Company processes your personal data based on lawful bases for the following purposes: 

• To enter into a contract and manage the contractual relationship between the Company and you
• To process orders for goods/services, including delivery, storage, product replacement, refunds, and after-sales services
• To manage financial transactions, such as payments, receipts, invoices, verification/cancellation of transactions, and cheque-related transactions
• To register and verify your identity prior to accessing services
• To provide order status information, service appointments, and product warranty information
• To contact and coordinate, report issues, provide advice, and update service status
• To manage complaints, disputes, investigations, or follow-up on services
• To provide customer support services, such as responding to inquiries, providing information, repairs, and other after-sales services
• To deliver products, documents, or information necessary for providing services to you
• To manage and improve the efficiency of products or services
• To analyze customer data, usage behavior, customer segmentation, consumption trends, and satisfaction
• To study information from purchase history, product models, and registration dates (online/offline)
• To enhance user experience and tailor content to your interests
• To monitor the use of online systems, such as log files, cookies, and website usage data
• To manage vendors/business partners, such as purchase orders, invoices, and business coordination
• To record images via CCTV for the security of persons and property
• To conduct internal/external audits, risk management, and corporate governance
• To manage emergencies and prevent or mitigate potential harm to individuals
• To improve service quality, resolve issues, and support qualitative development
• To gain further insight into products that customers may be interested in (product relevance)
• To evaluate the effectiveness of promotional campaigns

Note: The Company uses only cookies that are necessary for the operation of the website under the legitimate interests basis (consent is not required, but a notification will be provided).

• To comply with tax, accounting, labor, anti-money laundering, and other applicable laws
• To comply with court orders, governmental authorities, or relevant regulations
• To comply with personal data protection laws, such as responding to data subject rights
• To support investigations by regulatory authorities, security agencies, or judicial processes
• To prevent or suppress danger to life, body, or health of a person
• To prepare historical or archival documents for public interest or for research or statistical purposes
• To carry out tasks in the public interest of a bank or to perform duties in exercising official authority entrusted to the Company

In the event that you are unable to provide the personal data required by the Company in accordance with legal requirements for entering into or performing a contract with you, you acknowledge and understand that, in such case, the Company may not be able to carry out the aforementioned purposes.

In this regard, your failure to provide personal data to the Company may affect you, in that the Company may be unable to proceed with your requests or perform its contractual obligations. The Company may not be able to provide some or all of its services to you, and you may experience inconvenience or may not receive performance in accordance with the contract, and you may incur damage or loss of opportunity. In certain cases, failure to provide such data may affect compliance with applicable laws by the Company or by you and may be subject to relevant penalties.

5. Disclosure of Your Personal Data

The Company may disclose your personal data to third parties for the purposes set out in this Privacy Notice, which may include service providers, governmental authorities, or other relevant persons. You may also be subject to the privacy policies of such third parties. The Company therefore recommends that you review the privacy policies of such third parties.

5.1 Ricoh Group
As the Company is part of the Ricoh Group, your personal data may be accessed or disclosed to other companies within the Ricoh Group for the purposes set out in this Privacy Notice. In such case, other companies within the Ricoh Group are permitted to rely on the consent obtained by the Company.

5.2 Third Parties
The Company may engage other companies, agents, or contractors to provide services to the Company. In this regard, the Company may disclose your personal data to such third-party service providers, including but not limited to:

• Technology service providers, digital infrastructure, systems, and software providers
• Logistics, warehousing, and transportation service providers
• Auditors and inspectors
• Advertising, media, public relations, and communications service providers 
• Event organizers or marketing activity organizers 
• Sales agents
• Data storage and cloud system service providers
• Security service providers for premises
• Financial, legal, and technology advisors
• Affiliates, business partners, and business alliances
• Data analytics service providers
• Relevant associations or federations

Such service providers may need to access your personal data in order to perform their duties. The Company will disclose only the data necessary and will require such service providers to comply with personal data protection measures and not to use the data beyond the specified purposes.

5.3 Government Authorities, Regulatory Authorities, or Other Entities as Required by Law
In certain cases, the Company may be required to process or disclose your personal data to government authorities, law enforcement agencies, courts, officials, regulatory authorities, or other persons where the Company has reasonable grounds to believe that it is necessary to comply with laws or regulations, or to protect the rights of the Company, the rights of others, or for security purposes, including the investigation, prevention, or handling of fraud.

6. Cookies

In the event that you visit our website, we will automatically collect certain information from you through the use of cookies. Cookies are small pieces of data or text sent from your computer when you visit a website, and are used to store or track information about your use of the website. They are also used to analyse popularity, manage our website, track user movements on our website, or to remember user preferences. Certain types of cookies are strictly necessary, as without them the website may not function properly. Other types of cookies help us enhance your website experience, tailor content to your preferences, and facilitate your use of the website.

Most web browsers allow you to decide whether to accept or reject cookies. If you choose to refuse, delete, or block cookies, this may affect your user experience. Without cookies, your ability to use certain features or areas of the website may be limited.

In addition, third parties may use cookies through the Company’s website to present advertisements relevant to your interests based on your website browsing activities. Such third parties may collect your browsing history or other information to understand how you access the website and the webpages you visit after leaving the Company’s website. Information collected through these automated systems may be linked to personal data that you have previously provided on the Company’s website. In this regard, you may also be subject to the privacy policies or cookie policies of such third parties. The Company therefore recommends that you review the privacy policies or cookie policies of such third parties to learn more about how they process your personal data.

7. Cross-Border Transfer of Personal Data

7.1 The Company may send or transfer your personal data to overseas countries where necessary for the performance of a contract to which you are a party, or for the performance of a contract between the Company and another person or juristic person for your benefit, or for taking steps at your request prior to entering into a contract, or for preventing or suppressing danger to your or another person’s life, body, or health, or for compliance with the law, or where it is necessary for carrying out tasks in the public interest, or with your consent.

7.2 The Company may store your personal data on computers, servers, or cloud systems provided by other persons or juristic persons, and may use software or applications of third parties in the form of software-as-a-service or platform-as-a-service to process your personal data. In this regard, the Company will not permit unauthorized persons to access personal data and will require such third parties to implement appropriate personal data security measures.

7.3 In the event that it is necessary to send or transfer your personal data to overseas countries, the Company will comply with personal data protection laws and implement appropriate measures to ensure that your personal data is protected and that you are able to exercise your rights in accordance with the law. The Company will also require recipients of your personal data to implement appropriate safeguards and to process such personal data only as necessary, and to take measures to prevent unauthorized or unlawful use or disclosure of personal data.

8. Retention and Retention Period of Your Personal Data

8.1 The Company will retain your personal data for as long as necessary, taking into account necessity and the purposes, including compliance with applicable legal requirements, business standards, or ISO (International Organization for Standardization) standards applied by the Company, for example, retaining personal data for a period of 10 years in accordance with the statute of limitations.

8.2 The Company will continue to process your personal data even after you have terminated your relationship with the Company, to the extent necessary for compliance with legal requirements or for legitimate interests or will retain such data in a form that does not identify you, whether directly or indirectly, such as anonymized data.

8.3 The Company will conduct reviews to delete or destroy personal data, render it non-identifiable, or otherwise restrict personal data once the retention period has expired or when such data is no longer relevant or necessary for the purposes of processing, or when the Company is required to comply with your request to delete your personal data.

9. Rights of Data Subjects

The Personal Data Protection Act B.E. 2562 (2019) aims to provide you with greater control over your personal data. You may exercise your rights under the Personal Data Protection Act B.E. 2562 (2019) once the provisions relating to the rights of data subjects come into force, as detailed below:

1. Right to be informed: You have the right to be informed of the purposes of the collection, use, or disclosure of personal data, including clear details and the Cookie Policy.
2. Right to withdraw consent: You may withdraw the consent you have given to the Company at any time (in cases where the Company relies on consent as the legal basis for processing).
3. Right of access: You may request access to and obtain a copy of your personal data, and request the Company to disclose how such data was obtained where you did not give consent, unless the Company has the right to refuse your request under the law or a court order, or where your request may adversely affect the rights and freedoms of others.
4. Right to rectification: You may request correction of inaccurate or incomplete personal data to ensure that such data is accurate, up-to-date, and not misleading.
5. Right to erasure: You may request the Company to delete, destroy, or anonymize your personal data where it is no longer necessary or in accordance with conditions prescribed by law.
6. Right to data portability: You have the right to receive your personal data in a format that is readable or commonly usable by automated tools, and to request that such data be transmitted to another data controller.
7. Right to restriction of processing: You have the right to request restriction of the use of your personal data in any of the following cases:
   
   1. When the Company is in the process of verifying your request for rectification to ensure that your personal data is accurate, complete, and up to date.
   2. Where your personal data has been unlawfully collected, used, or disclosed.
   3. Where your personal data is no longer necessary to be retained for the purposes notified by the Company, but you request the Company to retain such data for the exercise of your legal rights.
   4. When the Company is in the process of proving legitimate grounds for the collection, use, or disclosure of your personal data, or verifying the necessity of such processing for public interest, due to your objection to the collection, use, or disclosure of your personal data.
8. Right to object to processing: You have the right to object to the collection, use, or disclosure of your personal data where such processing is based on legitimate interests or for direct marketing purposes, unless the Company has lawful grounds to refuse your request (for example, where the Company can demonstrate compelling legitimate grounds for the collection, use, or disclosure of your personal data, or for the establishment, compliance, or exercise of legal claims, or for public interest under the Company’s functions).
9. Right to lodge a complaint: You have the right to lodge a complaint with the Personal Data Protection Committee or relevant supervisory authority in the event that you believe that the Company, its employees, or its contractors have violated or failed to comply with the Personal Data Protection Act B.E. 2562 (2019).

In the event that you submit a request to exercise your rights under personal data protection laws, upon receipt of such request, the Company will proceed within the timeframe prescribed by law. The Company reserves the sole right and discretion to accept and proceed with or to refuse your request. In this regard, the Company reserves the right to refuse or not to act upon such requests where required by law, such as for compliance with the law or a court order, for public interest, or where the exercise of such rights may infringe the rights or freedoms of others. If the Company refuses such request, the Company will inform you of the reasons for such refusal.

10. Personal Data Security Measures

The Company places importance on the security of your personal data to ensure that the Company’s personnel and third parties acting on behalf of the Company comply with appropriate personal data protection standards, including the duty to prevent personal data breaches.

The Company will retain your personal data securely in accordance with appropriate technical measures, organizational measures, and physical measures to ensure the security of personal data processing and to prevent personal data breaches. The Company has established policies, rules, and criteria for personal data protection, including measures to prevent recipients of data from processing personal data beyond the specified purposes or without authorization or unlawfully. The Company regularly reviews and updates such policies, rules, and criteria as necessary and appropriate. In addition, executives, employees, contractors, agents, advisors, and recipients of personal data from the Company are required to maintain the confidentiality of personal data in accordance with the Company’s confidentiality measures, including personal data processing agreements.

The Company regularly reviews and updates its procedures and personal data security measures to ensure that the level of security is appropriate to the risks and to maintain confidentiality, integrity, accuracy, and availability of personal data processing on an ongoing basis. The Company also implements measures to protect against loss and unauthorized collection, access, use, alteration, modification, or disclosure of personal data.

11. Personal Data Collected Prior to the Effective Date of the Personal Data Protection Act

Where the Company has processed your personal data that you have provided to the Company by any means as a result of your relationship with the Company, whether as an employee, staff, customer, business partner, business alliance, shareholder, director, or in any other capacity, prior to the effective date of the Personal Data Protection Act, the Company hereby informs you that it will continue to collect and use such personal data only for the original purposes for which it was collected and used prior to the effective date of the Act.

The Company will not disclose such personal data to other persons unless your consent has been obtained or as permitted by law. 

If the Company intends to process your personal data for purposes other than the original purposes for which it was collected and used prior to the effective date of the Personal Data Protection Act, the Company will inform you and will process your personal data in accordance with the principles and methods prescribed by law. You may review further details regarding the processing of your personal data in this Privacy Notice.

In this regard, if you do not wish the Company to continue collecting and using such personal data, you have the right to withdraw the consent you provided to the Company prior to the effective date of the Personal Data Protection Act by contacting the Company using the contact details provided in this Privacy Notice.

12. Changes to the Privacy Notice

The Company will regularly review this Privacy Notice to ensure that it is consistent with applicable practices, laws, and regulations. In the event of any changes to this Privacy Notice, the Company will notify you of such changes together with the updated Privacy Notice through the Company’s website and other appropriate channels. In this regard, the Company recommends that you periodically review this Privacy Notice for any changes.

13. Contact Information

14. Governing Law

You acknowledge and agree that this Privacy Notice shall be governed by and construed in accordance with the laws of Thailand, and that the courts of Thailand shall have jurisdiction over any disputes that may arise.