Privacy Notice

Advanced Info Service Public Company Limited and Subsidiary Companies for Customer

Advanced Info Service Public Company Limited and Subsidiary Companies, as listed here (“Company”), emphasize in personal data protection and prioritize the security of your personal data, and therefore issue this Privacy Notice (“Notice”) for such purpose. The Company suggest you to understand the details of this Notice since it prescribes the process of data collection, store, uses and/or disclosure including your other rights as a data subject as part of the Privacy Policy of Advanced Info Service Public Company Limited and Subsidiary Companies. This is to make sure that you are informed and acknowledged of the Company's personal information protection measures. Therefore, the Company hereby announce the Notice as followings:

Scope of Notice
1. Natural person(s) who is customer / Service user
  - natural person(s) who is customer / service user of the Company
  - natural person(s) who disclosed personal data to the Company, or in which the Company received personal data, whether directly or indirectly, by any means
  - natural person(s) who is customer / service users who visit the Company’s website or application
  - natural person(s) who is customer / service users who enter the Company’s premises, including but not limited to offices, branches, service centers, or retail stores of the Company
2. Visitors
  - Individuals who visit the Company at its premises, including offices, branches, or retail stores
  - External parties who enter the Company's premises, including offices, branches, or retail stores
  - External parties who visit the Company's website or application, or who participate in events or public relations activities organized by the Company
Personal Data to be collected
“Personal Data” means any information pertaining to data subject, or enables the identification of data subject, whether directly or indirectly.

Personal Data that the Company collects, uses and/or discloses may be vary in accordance with the scope of service that you use or your other interactions with the Company, shall include but not limited to the following Personal Data:
- First name, last name, gender, date of birth, nationality, photos, picture and national identification number, and passport number
- Contact information: address, e-mail, and telephone numbers
- Signature, electronic signature, username, user identification number, or password of the service user.
- Information related to subscription or registration via the Company’s website or application
- Usage information of services, usage behavior, network services, and other information related to the provision of the services or the Company's business partners, including products related to the services.
- Financial information such as payment information, credit card numbers, and bank account numbers.
- Information related to security systems, including closed-circuit television (CCTV) data, image recordings, motion pictures, digital audio or other media.
- Information to be used to improve the quality of services, or to resolve customer’s use of service issues.
- Information necessary for complying with the laws, including information for investigation and use of any relevant actions in the event of any breaches of the terms of services or any unlawful acts.
- Information provided to assist specific user groups in need of special support.
- Information necessary to comply with laws, lawful requests from law enforcement agencies, and/or court orders, including those for establishing legal claims or defending the Company's legal interests.
Legal basis
It is necessary for the Company to collect, use, or disclose the above-mentioned data under Section 2 on the legal basis to perform our contractual obligations to comply with the requests of data subject prior to the effectiveness of such contractual obligations, or for complying with applicable laws. It may also be necessary for lawful interests, or for establishing legal claims, or for defending the Company's legal interests. If you do not provide the required personal data, the Company may be unable to perform its contractual duties with you.
Source of Personal Data
1. The Company may collect your personal data directly through various channels and activities, such as:
  - Information collected during the request submission, application, entering into the service agreements with the Company (e.g., registering for a new mobile number, applying for extra services, requesting for privilege or applying for internet subscription, etc.)
  - Information collected from your submitted survey, send-receive emails, or other communication channels between you and the Company.
  - Information collected from the use of service, network and other related to the services (e.g., your location data within the network or location data from GPS, etc.)
  - Information collected from the Company’s websites through cookies (e.g., Google Analytic following the Company’s Cookies Policy)
  - Information that you provided to the Company through online channels (e.g., mobile applications or Company’s website, etc.)
  - CCTV footage
  - Interactions or communications with the Company.
  - Identity verification processes, such as exchanging identification cards prior to entering the Company's premises, including branches, offices, or retail store.
2. The Company may receive your personal data from other sources not directly from you, where such a source has the right to disclose your personal data as permitted by law, such as government sectors, subsidiary companies, companies within the company's group or industry, additional service providers, co-providers of additional services, business partners, contractors, subcontractors that have been trusted by the Company to register, provide services/value-added, and also including public information sources, social media or public media.
Purpose of Collection, Storage, Usage and Disclosure of Personal Data
- To fulfill the service under a contract to which you are a party or to process the request before entering into a contract.
- To provide digital platform services, additional services, or provide any other benefits by the Company, subsidiary companies, companies within the Company's group or industry, additional service providers, or co-providers of additional services.
- To develop and improve the service network to be efficient.
- To facilitate the notification or tracking, claim of products and service payments, fees such as sending service charge notices, product and service purchase orders, notification for product and service payment, issue receipts and tax invoices.
- To perform data management for submission to any sectors that need to review, whether internal or external, to prevent fraud.
- To perform data analysis for the services, marketing plans, marketing activities of the Company and partners, which the Company is a contracting party or having legal relations.
- To inform and offer privileges, information, news, promotions, and other deals related to the application of, sell and purchase of products or services of the Company, including but not limited to any legal entities, partnership groups which the Company is a contracting party or having legal relations, through emails, messages, applications, social media, mobile phones, etc.
- To apply or register for the services, products ordering, products selling, payment services and online transactions or other services of the Company, subsidiary companies, companies within the Company's group or industry as well as any legal entities, partnership groups which the Company is a contracting party or having legal relations.
- To identify and verify the identity of the applicant for registration and access to the service.
- To comply with the law and/or other necessity purpose of the legitimate interests pursued by the Company.
- To fulfill other purposes as permitted by law to collect, store, use and disclose personal data without obtaining a consent from the data subject.
- To provide after-sale services or services requested by you and to support, inform, respond, and resolve any complaints.
- To survey or evaluate your understanding, needs and satisfaction.
- To report information to regulators and the public sector as authorized by law.
- To secure the data security and service network of the Company.
- To secure and prevent any crimes within the Company building and branches such as Closed-circuit television (CCTV).
- For the establishment, exercise or defense of legal claims on behalf of the Company.
- To fulfill the responsibilities associated with the Company's missions that serve the public interest.
- To prevent, secure and deter technological crimes, law violations, or any actions that threaten public peace and morals.
- for verifying personal identity prior to granting access to company premises, offices, branches or retail outlets.
- To verify and confirm the identities of third parties visiting the company's website or application.
Disclosure of Personal Data to other persons or entities
The Company shall not disclose your Personal Data to other persons and entities who are not affiliate of the Company, companies in the Company's group or industry, partner companies, or any agency, organization, legal entity or person related to the Company's services ("third-party"), except for the fulfillment of purpose to collect and process Personal Data as listed in Section 5 of this Notice, where the Company may disclose your Personal Data to the third-party as following:
- Company’s authorized distributors
- Logistic Service Providers
- Financial and Transaction Service Providers
- Cloud Service Providers
- Personal Data Processors
- Information Technology Service Provider, and Program or IT System Service Providers
- Professional Consultants
- Insurance Issuers that you are desire to use the service.
- Providers of additional services or other benefits to users operated by the Company, its subsidiary companies, companies within the Company's group or industry, or business partners of the group of companies.
- Any sectors that need to review the data management, whether internal or external, to prevent fraud.
- Government sectors, Law enforcement Agencies, and Regulators
- Other sectors that processing the Personal Data for the purpose as permitted by law, such as an Agency that obeys a legal order, auditors or legal proceedings/litigations.
- Any necessary third-parties to enable the Company to perform its business and provide service to you, including any performances in accordance with the purposes, to collects and processing Personal Data, as stated in the Privacy Policy.
- Subsidiary companies, companies within the group or industry of the Company, and business partners of the group of companies.
  
  You agree and acknowledge that the Company has hired or assigned its subsidiaries, service provider group companies, business partners, co-providers of additional services, or any agency, organization, legal entity, or individual to provide telephone communication services, additional services, and other types of services, including offering other benefits, to deliver services to you with the Company. This may include processing your personal data to provide these services. Therefore, the Company is required to disclose your personal data to its subsidiaries, companies within the same industry or business group, business partners, or any agency, organization, legal entity, or individual related to the Company's services, additional services, or any other benefits provided to you.
  
  In this context, the definition of a company within the same company group, business chain, or industry shall have the following meanings:
  
  "Companies in the Group Company" refers to the entities specified in this Notice, including those within the same business group or associated with the Company.
  
  “Affiliate or group of businesses” refers to a business entity in which the Company possesses the authority to control and govern other enterprises, or a business that is controlled by a company with such authority. This includes parent companies, subsidiaries, associated companies, or natural or juristic persons that are legally related or interconnected through joint economic activities, in accordance with the criteria established by generally accepted accounting standards.
Retention period of the Personal Data
1. The Company will retain your Personal Data during ongoing service for at least 90 days of use, unless you file a complaint regarding the service. A complaint may require your personal data to verify the accuracy of the service, bill for service fees, or assess the quality of the service. The Company will keep Personal Data only as long as necessary for verification until the complaint is resolved. However, the Company will not retain it for more than 2 years from the date the complaint was received, as required by law.
2. In the event of service termination, the Company shall retain your Personal Data for a minimum of 90 days from the date the service contract is terminated. Except where necessary or where there are outstanding service fees, the Company shall retain your Personal Data for no longer than 2 years from the date of termination or for the period specified by applicable laws.
3. In addition to providing you with telecommunication services, the Company will collect your personal data for as long as necessary to fulfill the purpose of each service type, in accordance with the contractual or legal relationship between you and the Company and applicable law.
Deletion or Destruction of Personal Data
The Company shall delete, destroy, or anonymize personal data in accordance with its data destruction standards upon the expiration of the retention period or when there is no longer a legitimate reason to collect, use, or process your personal data. The data shall be retained for an appropriate and necessary duration for each category of personal data unless the Company is unable to delete or destroy it due to legal obligations, such as compliance with applicable laws and regulations, internal operational requirements, legal demands, or requests from regulatory authorities.
Transferring Your Personal Data Overseas
The Company may transfer your Personal Data to our affiliates, companies in the Company's group, companies in the same business or group or industry, business partners, a group of partnerships which the Company is a contracting party with or having legal relations, including Cloud Platform Service Provider, in foreign countries. However, such transfer of data shall be for your benefits or benefits to the business as a whole, and for the purposes specified in Section 5 of this Notice, as well as for the Company's necessary operations.

You agree and consent to the Company transferring your personal data outside of Thailand to individuals or entities in other countries or under the jurisdiction of other countries, regardless of whether the data protection laws in those countries meet Thailand's standards. The Company will adopt appropriate measures to safeguard your personal data at a level equivalent to Thailand's personal data protection laws.

Furthermore, the Company reserves the right to transmit or transfer personal data to affiliated entities or companies within the same corporate group situated overseas. The Company has established policies to safeguard personal data when dispatching or transferring it to foreign data controllers or processors, as well as within the same corporate group or affiliated entities for collaborative business activities.
Consent
In cases of the Company cannot rely on other legal bases. The Company may further ask for your consent to collect, use, or disclose Personal Data in the following cases:
1. Sensitive Data, only as necessary for the use or to provide certain services from the Company e.g., data of individual who has visual or hearing impairments, or for the purpose of identity authentication e.g., biometrics. In case that the Company may not apply other legal basis, the Company will ask for your explicit consent.
2. For the analysis, research, statistics, including the development of products or services of the Company or business partners that are not for the public interest. In case that the Company may not apply other legal basis, the Company will ask for your explicit consent.
3. For the operations of marketing, offering of products and services, news, beneficial advice, marketing strategy, or privileges from the Company or business partners. In case that the Company may not apply other legal basis, the Company will ask for your explicit consent.
4. In case that the Company acknowledge that the data subject is a juvenile, in which the Company require to have consent from parents or guardians, the Company will not collect, use, or disclose Personal Data of relevant juvenile until the consent from authorized guardians is given, unless there is a legal basis for the Company to proceed without consent.
Your Rights related to Personal Data
You may exercise your rights as permitted by laws, current enforced policies or to be amended in the future, by contacting Company’s representative or exercise the rights by yourself, in the channel provided by the Company, to submit the request, in which the Company will further request an evidence to authenticate your identity as data subject.

The Company may charge additional fees on case-by-case basis if it is found that your request is groundless, repetitive, or unnecessarily excessive, and the Company may refuse any untrustworthy, unreasonable, or impractical requests, or may reject your request in accordance with any regulations as defined by law.

With regards to such requests, you have the rights to submit your claims to the Personal Data Protection Commission in accordance with the regulations as specified by the law.
1. Right to Withdrawal of consent
  When you consent to the Company for the specific purpose, you have the right to withdraw your consent at any time, except there are legal restriction or contractual obligations which are beneficial to you. Therefore, withdrawal of your consent may affect your benefits, you should therefore study, inquire about the impact before exercise your right. If your withdrawal causing the Company unable to deliver product or provide some service to you, the Company will inform you about the impact of such withdrawal. In this regard, the withdrawal of consent will not impact the collection, usage, or disclosure of your personal data prior to such withdrawal.
2. Right to Access and Make a copy of Personal Data
  You have the right to access, request a copy of Personal Data such as a copy of Call Detail Record (CDR), invoice or receipt in accordance with the requirements and methods set by the Company at AIS Service Center or via myAIS application at any time or request the Company to provide the acquisition of Personal Data. Therefore, the Company may refuse your request as required by law or by court order, or if your request may cause damage to rights and freedom of third party.
3. Right to Data Portability
  You have the right to obtain your Personal Data in case that the Company has converted your Personal Data in automatic machine-readable or usable format and can be used or disclosed by automatic means, and may request the Company to send or transfer your Personal Data to third party, or obtain the Personal Data that the Company sent or transferred to third party, except in case that the Company cannot execute such portability by automatic means, or it is technically impractical, or the Company have the right to reject your request in accordance with the law.
4. Right to Objection
  You have the right to object the collection, usage, or disclosure of Personal Data as follow, however such objection may cause the Company unable to provide you certain services:
  - Object to receive advertising message or other electronic information from the Company.
  - Object to receive advertising message or other electronic information from value-added service providers that are contracted parties with the Company.
  - Object to receive advertising message or other electronic information from business partners of the Company.
  - Object to receive service charge collection notice via message or other electronic information.
  - Object to receive service charge collection notice via telephone.
  - Object to receive any offer of products, services, and promotional marketing via telephone.
  - Object to receive any direct marketing.
    
    However, in case that your objection to collect, use, and disclose of Personal Data and such Personal Data is necessary for the Company to perform its lawful operation or for public tasks, the Company may continue to collect, use, and disclose your Personal Data if the Company can lawfully demonstrate prevailing reason, or for the purpose of establishment of legal claims, compliance of legal claims, or defense against legal claims.
    
    In this regard, the Company may reject your request in accordance with the law, court order, or in case that your request may cause damage to rights and freedom of third party.
5. Right to Processing Suspension
  You have the right to temporarily suspend processing Personal Data in the event that the Company is in the process of reviewing your request to rectify your Personal Data or objection request or any other cases that the Personal Data is no longer necessary for the Company and needs to erase or destroy such Personal Data in accordance with applicable law, but you instead exercise the right to suspend.
6. Right to erase or destroy
  You have the right to request the Company to erase or destroy your Personal Data or anonymize your Personal data except it is necessary for the Company to perform its obligations under the contract in order to provide a service or there are any legal rights to refuse your request.
7. Right to Data Rectification
  You have the right to rectify or change your Personal Data that is not correct or inaccurate in order to keep such data up-to-date. However, it is depending on the requirements of other applicable laws.
8. Right to Complain
  You have the right to complain regarding Personal Data via the communication channel of the Company in order to receive explanation or provisional solution from the Company, or submit your complaint to the supervising authority in accordance with the Personal Data Protection Act. B.E. 2562
Security measure and Quality of Personal Data
1. The Company recognizes the importance of maintaining the security of your Personal Data. Therefore, the Company has established measures to maintain the security of Personal Data appropriately and consistency, and make your Personal Data confidential to prevent loss, access, destruction, use, conversion, modify or disclosure of Personal Data without rights or unlawful in accordance with the AIS Group’s Cyber Security Policy and applicable laws relating to the security measures for the protection of personal data.
2. Any Personal Data that the Company received from you such as name, residential address, contact number, identification number, financial information which is completed and up-to-dated relating to an identified or identifiable of your identity will be used in accordance with the objectives of the Company. The Company will carry out appropriate measures to protect your Personal Data.
Marketing Activities and Promotions
During the use of the Service, the Company, its affiliated companies, companies within the Company's group, companies in the same business group or industry, business partners of the Company's group, advertisers, or additional service providers may send you information related to marketing activities and promotions of product or service of the Company, including digital platform services, value-added services, or other benefit services that you may interested. You can withdraw your consent to receive the information via the channel as specified by the Company.
Privacy Policy of Third Party Websites
This Notice is only applying to the Company's services and website. If you are accessing to other websites, whether from Company’s website or not, you will have to study and comply with the privacy policies of any third party websites, separate from the Company’s website.
If You Refuse to Disclose or Use Your Personal Data
The Company may necessary collect, use or disclose your Personal Data in accordance with the law or for enter into a contract with you, or for other purposes specified in Section 5 of this Notice. If you wish not to provide your personal data to the Company, it may cause the Company unable to provide a service to you in case that the Company use your Personal Data to perform its obligations under the contract, or for other purposes specified in Section 5 of this Notice, and in compliance with the law.

If the Company needs your permission to collect, use, or share your Personal Data (because there is no other legal basis), and you choose not to give this permission, you may continue to use the service of the Company. However, it may be causing you to receive less convenient from the use of service due to the Company does not obtain a consent to effectively use you Personal Data for the purpose.
Operations, Practices and Policies with respect to Personal Data
The Company has complied with laws, including the Notification of the National Telecommunications Commission on Measures for Protection of Telecommunications Service Users’ Rights Related to Personal Information, Privacy Rights and Freedom to Communicate by Means of Telecommunications, and other applicable privacy laws, as well as, publish a NBTC Privacy Guideline on the Company's website.
Data Protection Officer
The Company has undertaken the Personal Data Protection Act. B.E. 2562 by appointing the Data Protection Officer (DPO) to monitor the operation of the Company with respect to the collect, use and disclose Personal Data in accordance with the Personal Data Protection Act B.E. 2562, including relevant personal data protection laws. In addition, the Company has rules and regulations to regulate the related parties to undertake their duties in accordance with the Privacy Policy and in line with the policy of the Personal Data Protection and Cyber Security Supervision Committee as specified by the Company.
Contact Information regarding Personal Data
Customer and Service Management Business Unit
Advanced Info Service Company Public Limited and subsidiary companies
414 Phaholyothin Road, Samsen-Nai, Phayathai, Bangkok 10400
Or Data Protection Office Unit
[email protected]

From time to time, The Company may amend this Notice as the Company deemed reasonable or necessary. In case of amendment, the Company will announce the updated Notice on website of the Company.

Last update: September, 2025