Privacy policy

This is a translation, provided for convenience only. The Thai-language privacy policy is the legally binding version. Where this English text and the Thai text differ, the Thai version governs — as clause 2.a of the policy itself provides.

Anri Holding Co., Ltd. ("ANRI", "the company" or "the company's") regards the protection of its users' privacy as a matter of the first importance. The company has therefore drawn up this privacy policy ("the privacy policy") to make clear how it handles personal data while continuing to serve its users as effectively as before. The particulars are as follows.

1. Introduction

Anri Holding Co., Ltd. ("ANRI", "the company" or "the company's") believes that your privacy is of the first importance in meeting the company's commitment to respect and protect it. The company will observe the following basic principles.

1. The company will inform you of the personal data it is to collect, and will seek your consent as it sees fit in order to collect, process for use or disclose your personal data.
2. The company will state the purpose for which your personal data is collected and processed.
3. The company collects only the data necessary to fulfil the stated purposes of use.
4. The company will use or disclose your personal data only for the purposes for which it was collected, unless it has your consent or applicable law requires or permits otherwise, and the company will keep your data only for as long as those purposes require.
5. The company will endeavour to ensure that your personal data is accurate, complete and current.
6. The company will put in place appropriate technical and organisational standards to protect your personal data appropriately.
7. The company will draw up its policies and practices so that the handling of your personal data is as transparent as is reasonably possible.
8. You will have the right to access your personal data and to have it corrected as appropriate, together with the rights available to you under applicable law.
9. The company will be accountable to you, and welcomes your views on its observance of these principles, of this privacy policy and of applicable law.

2. Scope of the privacy policy

a. The aim of the privacy policy

This privacy policy explains how ANRI handles and protects your personal data, and the rights and choices available to you in relation to it. It applies to personal data the company collects from you when you use applications for installation, service and marketing relations through the LINE platform ("the LINE application"), the various services available in the LINE application and other ANRI web applications that do not operate together with the LINE application (together, "the applications"); to personal data the company collects from you when you visit the company's websites ("the websites") (the applications and the websites together, "the services"); and to personal data about you received from other users.

So that the company's privacy policy is easier to understand for users whose main language is not Thai, the company may provide a translation into your local language for reference. However, in the event that any provision of a translated version conflicts with the Thai-language privacy policy, the Thai version shall apply instead, unless otherwise stated and as far as applicable law permits.

This privacy policy applies if you use the services, or any part of them, from anywhere in Thailand.

b. Which privacy policy applies to ANRI's other services

Users may take up further services from ANRI or from companies in the ANRI group ("additional services"). Because each user's needs and choices may differ, the company provides a separate privacy policy, or an addendum to this privacy policy, for the relevant additional service.

Those separate privacy policies and addenda explain the categories of data the company collects, the purposes of use and any other policies that may apply to that additional service. When you choose to use an additional service, you will be told which privacy policy or addendum applies — supplementing or amending this privacy policy — before you can access that additional service. Please note that you may review the privacy policy and addenda applying to the service you use.

3. The categories of personal data the company collects

a. What personal data ANRI collects

When you create an account and use the services, ANRI collects, transfers, processes and uses the following categories of data.

i. Data about your user account

When you sign up for the company's services, or sign up for ANRI's applications in order to use the services ("user account"), ANRI collects your personal data. The particulars are as follows.

• The data shown on your national identity card, comprising your given name, family name, date of birth, national identification number, address and photograph. This data is necessary in order to verify your identity and to make it easier for you to complete the membership registration details.
• Your current address. This data is necessary in order to deliver goods to you when you order through ANRI's online channels.
• Your telephone number.
  This data is necessary because the company may send SMS messages to the number you give in order to detect and continuously prevent unauthorised, fraudulent or improper use of the services. The company may also use the telephone number you register to send you important information about the services.
• Receipt data, comprising the receipt number, the purchase total and the points collected, for the purpose of using promotions or sales coupons.

ii. Device data and access logs when you use the company's services

When you use the company's services, the company may obtain and retain electronic identifiers, or records obtained automatically from your device — the device type, the operating system, the device's type and language settings, and cookie data. This data is necessary for the company to detect and continuously prevent unauthorised, fraudulent or improper use of the services, and to provide the service best suited to your device and most capable of being configured by you. Please note also that third-party advertising identifiers are linked to your account through the company's internal identifier.

iii. The company will begin to use the personal data only of users who have given consent under "About the use of your data"

• Messages, images, video and so on (content) posted or sent to an official account (LINE Official Account) and the like; and
• the destination, the date and time, the form of the data, access data, URLs and so on when content is sent.

The company will restrict the use of the data described above to users who have consented to that use. You may change your consent at any time from the "Settings > Privacy" page in LINE. In addition, in order to make clear the categories of data the company receives and how the company uses it, the company has reorganised the data it receives together with the purposes for which that data is used.

b. What other data ANRI collects from the LINE application

To improve the effectiveness of its services, the company provides additional functions, including the ability to reach your account from the LINE application and from several devices, so that the services are more effective, more convenient and more enjoyable to use. Should you choose to link your ANRI user account to your LINE application user account, the company needs to ask you for the data below. You may choose not to give some of it; however, if you do so there may be parts of the services you cannot use.

i. Universally Unique Identifier (UUID)

A user ID unique to each provider. This data is necessary, and the company uses it to verify the identity of the LINE application user.

ii. Display data (LINE Display Name)

iii. Profile image data (Profile Image)

iv. The user's status message (Status Message)

v. Location data [optional]

vi. Contact data for customer support [optional]

In some cases you may wish to contact the company for customer support. Should you contact the company by email address, by telephone or by any other means, the company may obtain and retain any data you choose to give, including your name and contact details such as your email address and telephone number, as well as data about your mobile device or personal computer, such as the device type and its operating system. The company uses this data to resolve and investigate the problem you have raised with it, in order to help you and to go on improving the company's customer support. The company may process this data, which relates to the help you have asked for, in order to manage your user account, and retains it in accordance with the provisions of this privacy policy.

vii. Contact data for sales promotions and customer surveys [optional]

Should you choose to take part in the sales promotions or research surveys ANRI offers from time to time, the company may ask for your contact details (such as your name, postal address, telephone number, email address, gender, date of birth or other data) in order to confirm your eligibility to take part, to enable you to complete the questionnaire, to send any prize you may win, and to administer other activities.

viii. Data from websites and applications in which the company's services are embedded [optional]

The company's services and/or third-party websites and applications may have the company's web applications embedded in them. The company may record your LINE login data through the use of those embedded applications, or receive the URL of a website carrying one of the company's embedded applications that you visit while logged in to the company's services through your browser. Data received in this way is used for the purpose of examining how the company's services are used, and of maintaining and improving them. Please note that no personal data about you will be received from such a website or application carrying the company's applications if you log out of the services.

c. Whether ANRI collects personal data from third parties

As to data about the use of services operated by third parties, in order to provide the services of greatest benefit to you, the company may receive personal data from third parties. In receiving such data there may be cases where personal data comes from a partner providing a particular service, including cases where personal data comes from partners providing services linked to the official account, from logging in to the services, and from other services. Should you use any service linked to a third party, the company may issue an internal code automatically in order to connect your personal data to that service and to share the same with that third party.

4. How the company uses and manages your data

a. How ANRI uses my data

In providing the services and any additional services, ANRI — as data controller or joint data controller — uses your personal data for the purposes of this privacy policy, as follows.

i. To develop, provide and improve the company's services

• To provide the services and any additional services to you, and to allow you to send your user-generated content to the owner of the official account.
• To provide the service of collecting points earned on your purchases.
• To run sales promotions.
• To let you sync your LINE account with other applications of ANRI, of companies in the ANRI group and of ANRI's business partners.
• To enable the company to provide customer support and to answer your questions and claims effectively.
• To carry out user surveys.
• To notify you of any other important information about the services and additional services where necessary.
• To identify the winners of competitions in sales promotions, to send prizes to the winners, and to deliver the products and services purchased.
• To compile anonymised statistical data about the services and additional services.
• To comply with applicable law or with legal obligations.

ii. To keep the services secure or to prevent unauthorised use

• To verify your identity.
• To monitor, detect and prevent unauthorised, deceptive or improper use of the services.
• To enable you to check for yourself, or to notify you, in the event of unauthorised use.

iii. To tailor the services to your needs or to publish advertising

• To provide information and the like about the company's services and those of the group of companies, or information about advertising.
• To improve and/or develop the services and any additional services to their greatest benefit.
• To measure the effectiveness of the advertising the company places on the internet or in other media. Should the company notify you of a further specific purpose of use at the time it obtains your personal data, or by any other means, that notice will replace the general purposes of use set out in clause 4.a of this privacy policy.

b. How ANRI protects my personal data

In meeting its obligation to respect and protect your privacy and to keep your personal data confidential, ANRI applies appropriate technical and organisational security standards, including industry-standard safeguards, to prevent unauthorised access to or disclosure, misuse, alteration or destruction of your data. Because no method of electronic transmission and no method of storage is perfect or impenetrable, the company cannot guarantee that your personal data will be absolutely safe from intrusion while being transmitted or stored in the company's systems. To help protect your privacy and keep your personal data safe, the company needs your help: please do not share your password, and do not use the same password you use for other services. Please also tell the company by email address or telephone number if you suspect unauthorised use of your account or any other breach of security.

c. Where my personal data is sent and stored

In order to provide a service that is trustworthy and responsibly run, ANRI processes and stores your data on secure servers located principally in Thailand, and data may also be stored on servers meeting a high security standard in various places around the world, including Singapore and Japan, where ANRI's processors are located. Those transfers are made in accordance with the requirements of applicable law and regulation.

d. How long ANRI keeps my data

ANRI keeps personal data for as long as your account remains active, for as long as is necessary to fulfil the purposes of use described in this privacy policy, or to comply with applicable law and regulation. The company may keep your personal data even after your account has been closed or terminated, where it is reasonably necessary to do so for the following reasons.

• To comply with applicable law and regulation or with legal obligations.
• To provide customer support fully and completely.
• To settle disputes between ANRI users or with them, for as long as is applicable.
• To detect and prevent unauthorised, fraudulent or improper use of the services.

e. Whether ANRI shares data with companies in the group

ANRI shares personal data with companies in the ANRI group, including companies appointed to act as data processors on ANRI's instructions.

• The personal data shared is the same as that listed in clause 3 of this privacy policy.
• The purpose of the sharing is the same as the purposes of use set out in clause 4.a of this privacy policy. (For the purposes of use after sharing, read "the ANRI group of companies" for "the company", and "the services provided by the ANRI group of companies" for "the services".)
• Should you have any question about the sharing of data within the group, please contact the company by email address or telephone number.

f. Whether ANRI uses outside service providers or service agents

In order to provide the services, ANRI sometimes needs third-party service providers to process user data, which may include your personal data. The company selects such third-party service providers strictly, and takes reasonable steps to satisfy itself that they have put in place appropriate and secure data management systems and internal organisational controls. The company also imposes contractual obligations on those providers requiring them to comply with applicable law and regulation on the processing of personal data. In addition, the company requires those third-party service providers to access your personal data only within the scope necessary under the company's instructions and for the company's purposes.

g. Whether ANRI gives my data to third parties

Save as described above in this privacy policy and in any other relevant privacy policy or addendum, ANRI will not give your data to any other person without your consent, unless the company believes in good faith that it is required or permitted to do so under applicable law, and except in the following case.

• Where you use a service linked to a third party, or in other cases where the minimum data necessary is given to a partner in order to identify the user. In such cases the company gives only the minimum data necessary to the third party (the internal code, certain data about the device — the advertising identifier, the language setting and so on — and data about the source). In giving a name, address, telephone number and the like, the company will satisfy itself that it has confirmed your intention once again. The recipients may include companies outside the country or region in which you live. On the above, please refer to the particulars in clauses 3.d and 6.a of this privacy policy.

h. Whether ANRI uses cookies or similar technologies

The company uses cookies or other similar dedicated storage technologies. A cookie is a small file kept on your computer when you visit a website; it stores data that the website can read again on your next visit. Some cookie data is necessary, because without it the website could not work properly. Other cookie data makes things easier for visitors by remembering the username securely and in the language you have chosen. Cookies exist so that you need not enter the same information every time you visit the website. We use cookies to:

• help the company maintain your session data when you use the services and/or any additional services;
• improve the security of our systems;
• store preferences and provide services configured to your needs; and
• help the company understand how people use the services, and improve them.

We also use the following third-party cookies on the website.

• Google Analytics.
• Meta Pixel and Meta Conversions API, used to measure contact actions and delivery clicks after consent.

Your continued use of the services indicates that you accept the company's use of cookies and similar technologies in accordance with this privacy policy. Most internet browsers allow you to control whether cookies are accepted. Should you disable cookies or limit the ability to set them, you may not be able to enjoy the benefits of the website or reach all of its functions, which may limit your use of it overall.

i. Whether ANRI uses third-party modules

ANRI uses third-party advertising agencies to place advertising on the internet or in other media. In order to measure the effectiveness of that advertising and to determine the amount payable to those agencies, the company installs third-party modules within its applications.

The company may also install third-party modules within its applications to help it understand how the services and/or additional services are being used.

5. Your choices — your rights

It is possible that ANRI may receive personal data about a person who is not currently a user of the services. Please note that whether or not you are a user of the services, you have the choices and the rights set out in this clause if the company holds your personal data.

a. How I control my data

Subject to applicable law (including any exception or exemption under it), you may have the right to access your personal data, the right to have errors in your personal data corrected, the right to object to the processing of your personal data on lawful grounds, the right to data portability and so on. You may exercise these rights directly through the company's email address or telephone number.

However, where applicable law permits, the company may be unable to meet your request in the following circumstances.

• Refusal to erase or destroy, where the data is necessary for compliance with the law, or is held so that the parties may perform a contract or provide services under a contract between them.
• Where disclosure may endanger the life, body, property or any other right or interest of yourself or of another person.
• Where disclosure may seriously obstruct the proper conduct of the company's business.
• Where disclosure would be contrary to other law; or
• where you do not verify your identity when requesting disclosure. Should you no longer wish to use the services, or no longer wish to consent to ANRI collecting and using the personal data necessary for the company to provide its services, you may choose to have all of your accounts deleted by making that request to the company by email address or by telephone. The company will delete your data in accordance with clause 4.d.

Should you exercise any of your rights as permitted by applicable law using the contact form, the company may charge a fee based on the administrative cost of responding to your request, in accordance with the procedure set out separately.

b. What to do if I change my mind

Should you change your mind about the extent of the data you wish to go on sharing or disclosing, you may choose to unlink all of your ANRI accounts from ANRI's LINE Official Account by making that request to the company by email address or by telephone.

6. Other important information

a. Advertising

The company endeavours to publish advertising that matches the needs of each user as closely as possible (optimised advertising). At the same time, given the nature of the services, the company regards privacy and the creation of an environment in which you feel safe using the services as important. Weighing your convenience against your privacy, the company has therefore laid down a number of prohibitions on the publication of advertising. You may at any time choose for yourself to suspend the publication of such advertising or to have it resumed.

b. Questions, suggestions and concerns

Should you have any question, suggestion or concern about this privacy policy or about the company's other privacy practices, please contact the company by email address, by telephone, or in writing at:

Anri Holding Co., Ltd.

บริษัท อันริ โฮลดิ้ง จำกัด

11 Soi 15, Nimmanhaemin Road, Suthep Sub-district, Mueang District, Chiang Mai 50200, Thailand

Telephone: (+66)830-485-7888

Email: anri.operation@gmail.com

c. Changes to this privacy policy

The company may amend its privacy policy from time to time for a variety of reasons, including in order to improve its privacy practices, to keep pace with changes to its services and to comply with the relevant law. The company drew up this privacy policy on 15 June 2022. Should the company make a material change to its privacy policy, it will notify you within its services or by other reasonable means. The company recommends that you review any such change carefully. If you agree to the change, please go on using the company's services; but if you do not agree to it and no longer wish to use the company's services, you may choose to close your account. Your continued use of the company's services after notice of the change has been given to you, or after it has been announced within the company's services, is taken as your acceptance of the change and your consent to this amended privacy policy. The company will seek your consent where applicable law requires it.