logoGREENLEAF

PDPA Compliance

Last Updated: March 1, 2025

Thailand Personal Data Protection Act (PDPA) Compliance

At Greenleaf, we are committed to protecting your personal data and complying with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). This document outlines how we adhere to the PDPA requirements and respect your data protection rights.

1. Data Controller Information

Greenleaf textile Co., Ltd. acts as the data controller for personal information collected through our website, in-store interactions, and other business operations. Our Data Protection Officer can be contacted at:

Email: info@gleaftex.com
Address: 8, 4 Soi Champee, Tambon Su Thep, Mueang Chiang Mai District, Chiang Mai 50200, Thailand
Phone: +86 13407586044

2. Legal Basis for Processing

We process your personal data only when we have a lawful basis for doing so under the PDPA. The legal bases we rely on include:

  • Consent: When you have given explicit consent for processing your data for specific purposes
  • Contractual Necessity: When processing is necessary to fulfill a contract with you
  • Legal Obligation: When processing is required to comply with our legal obligations
  • Legitimate Interests: When processing is necessary for our legitimate interests or those of a third party
  • Vital Interests: When processing is necessary to protect someone's life
  • Public Interest: When processing is necessary for performing a task in the public interest

3. Collection of Personal Data

We collect personal data directly from you when you:

  • Create an account on our website
  • Make a purchase online or in our stores
  • Subscribe to our newsletter
  • Contact our customer service
  • Participate in surveys or promotional activities
  • Apply for employment with us

We collect only the personal data that is necessary and relevant for the purposes for which it is being processed.

4. Rights of Data Subjects

Under the PDPA, you have the following rights regarding your personal data:

  • Right to Be Informed: You have the right to be informed about the collection and use of your personal data
  • Right to Access: You have the right to request access to your personal data
  • Right to Rectification: You have the right to have inaccurate personal data corrected
  • Right to Erasure: You have the right to request the deletion of your personal data in certain circumstances
  • Right to Restrict Processing: You have the right to request the restriction of processing your personal data
  • Right to Data Portability: You have the right to receive your personal data in a structured, commonly used format
  • Right to Object: You have the right to object to the processing of your personal data
  • Rights Related to Automated Decision-Making: You have rights related to automated decision-making and profiling

To exercise any of these rights, please contact our Data Protection Officer using the contact information provided above.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Different types of personal data may be kept for different periods of time depending on the purpose for which they were collected.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

  • Encryption of personal data where appropriate
  • Regular security assessments and testing
  • Staff training on data protection
  • Access controls to personal data
  • Processes for regularly testing, assessing, and evaluating the effectiveness of security measures

7. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify both the relevant supervisory authority and you as a data subject without undue delay, as required by the PDPA.

8. International Data Transfers

If we transfer your personal data to countries outside of Thailand, we ensure that adequate safeguards are in place to protect your data in accordance with the PDPA. These may include transferring data to countries that have been deemed to provide an adequate level of protection by the Personal Data Protection Committee or using specific contracts approved by Thai authorities.

9. Changes to This Statement

We may update this PDPA Compliance Statement from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this statement periodically to stay informed about how we are protecting your information.

10. Contact and Complaints

If you have any questions about our PDPA compliance or wish to make a complaint, please contact our Data Protection Officer at dpo@gleaftex.com. You also have the right to lodge a complaint with the Thailand Personal Data Protection Committee if you believe that we have violated your data protection rights.