Privacy Policy for SiamPoints

This Privacy Policy informs you how First Class Tech Ventures Co., Ltd., as operator of the platform “SiamPoints” (siampoints.com, hereinafter “we”, “us” or “SiamPoints”), collects, uses, discloses and protects personal data in accordance with the Thai Personal Data Protection Act, B.E. 2562 (hereinafter the “PDPA”).

This Privacy Policy is addressed to:

• Business partners (businesses, establishments, shops) and their authorized representatives and employees.

• Users / guests who use the SiamPoints platform to collect points at participating businesses, book appointments or shop in connected online shops.

• Sales partners (promoters as well as business and promotion partners), associations and partner companies we work with, and prospective customers and visitors to our website.

1. Which Personal Data We Collect

We only collect data that is strictly necessary for the provision of our services.

1.1 Data of business partners (businesses, shops) and their employees

When you register with SiamPoints as a business, we collect:

• Registration details: the name of the establishment as guests see it (a trading name of your choice is allowed), the industry, the location (address with coordinates for the map and the nearby search), the first and last name of the person registering, a phone number and an email address. We do not ask for an ID number, tax ID, legal form or documents at registration.

• Business and financial data: on a voluntary basis, the tax ID (for sole proprietorships, the number of the Thai national ID card) and the company details if the business would like a tax invoice; the payment details the business itself enters for payments from its guests (PromptPay number, bank details and name of the recipient); for the online shop and for online payments for reservations, the details of who is selling (first and last name as on the ID card, or the company name as registered).

• Personal identification data: only in industries with a particular risk, before online reservations and online payments are activated there (section 3 of the Terms of Use): the documents required for the industry (e.g. licenses, permits and proof of insurance) and, where applicable, an identity check via our service provider Sumsub using an identity document and a selfie or short video. In the process, Sumsub processes biometric data (face matching and liveness detection) — only with your express consent, which you give before the check.

• Contact details (owners & employees): first and last name, phone number, email address and, on a voluntary basis, LINE ID and website URL; for employees who sign in with the staff login, first name, phone number and PIN.

• Sign-in and security: We store passwords, PINs and backup codes only in a form that cannot be read. Anyone who turns on sign-in with a second factor (2FA) uses an authenticator app for it. If you sign in with your face, fingerprint or your device’s PIN (passkey), these features stay on your device; we store only a public key and the name of the device, never any face or fingerprint data. We also store the devices on which you are signed in. If you sign in via Google, Apple, Facebook or LINE, we only link this account after you have confirmed your email address with a code from us.

• Subscription and payments to SiamPoints: invoices, receipts, incoming payments, uploaded payment slips together with the result of their automatic check, withholding tax certificates (50 Tawi), booked advertising and orders from the promotional materials shop (with the delivery address). For payments by card or PromptPay via Stripe or Opn Payments/Omise, we receive from the provider only the details we need to match the payment (such as amount, time, payment status and a reference), never the full card details.

• Use of the platform: the acceptance of our terms with time and version (for example at registration, when printing QR templates and when switching on broadcasting), the save actions in the account area with time, type, establishment and IP address (section 5), support requests with attachments, feedback and ideas and, where applicable, the code of an association or partner company.

• Prospective customers: If you contact us via our website, or if a sales partner or our team reports an establishment to us as a prospective customer, we store the name of the establishment, the location, the contact person, the phone number, on a voluntary basis the LINE ID and website and — in the case of sales partners — a photo with which the sales partner documents the visit to the establishment. With these details, the sales partner can pre-fill the registration via a personal QR link; the link becomes invalid after registration.

1.2 Data of end customers (guests / users)

When you, as a guest, use the services of a business connected via SiamPoints, we collect the following data in the course of your use of the platform:

• For your account and sign-in: your email address — you sign in without a password, using a code or link that we send you by email —, optionally your name and, if you sign in via Google, Apple, Facebook or LINE, the details listed in section 1.3. To keep you signed in, we remember your device for up to 400 days. You do not need a mobile phone number, a password or a PIN.

• For collecting loyalty points: your points bookings and redemptions per business (business, time, points), as well as feedback and requests you send to a business via SiamPoints (such as a rating or a message). This is based on your account, not on your mobile phone number.

• For online reservations and appointment bookings: name, email address and other specific information requested by the respective business to carry out the appointment (e.g. number of persons, special requests) — including in the business’s own additional fields, for which the business itself is responsible.

• For purchases in the online shop: first and last name, delivery address, billing address and transaction data for processing purchases from the respective business. A phone number only if you enter it yourself for a delivery; the business sees it only on that order. If you upload a payment slip, we process its image as well as the payer’s name, the amount and the time; if the business switches on the automatic check, it runs via the business’s own account with a verification service (such as SlipOK, EasySlip or Thunder).

• For messages from businesses (broadcasting): If you agree to receive messages from a business via a service, we store this consent per business and service as proof (time, version of the wording, how consent was given, IP address), the identifier by which the service recognizes you, and your unsubscriptions.

1.3 Technical data and cookies

When you use our platform, we automatically collect technical data (e.g. IP address, browser type, access times) that is required for the secure operation of the website (e.g. through content delivery networks and web application firewalls protecting against cyberattacks and bots) and to comply with the Thai Computer Crimes Act. We use only technically necessary cookies that are strictly required for the functionality, routing and security of the platform — for example for sign-in, the language you have chosen and protection against bots. We do not set any advertising or analytics cookies.

Security services, fraud prevention and payment processing: To protect the platform against fraud, abuse and automated attacks, we use the following service providers: Cloudflare, Inc. (USA) uses “Cloudflare Turnstile” during registrations and sign-ins to check whether a human is submitting the form; in doing so, your IP address and technical characteristics of your browser are processed. When businesses and guests register, we store the IP address and have IPinfo, Inc. (USA) determine the country, the network operator and – where available – the approximate region, as well as any indication of a connection via VPN, proxy or data center. This information is visible only to authorized SiamPoints staff for the purpose of fraud prevention, is never used for advertising or to display content or offers, never leads to an automatic suspension and is deleted automatically after 12 months. Businesses may pay their subscription fees by card or PromptPay via Stripe (Stripe, Inc. and its affiliates) or Opn Payments/Omise (Thailand); card data is processed directly by the respective provider and is never stored by SiamPoints. These providers may process personal data outside Thailand, in particular in the USA. The legal basis is our legitimate interest in the security of the platform and in the prevention of fraud (section 2.2) or the performance of the contract (section 2.1); for transfers abroad, we ensure appropriate safeguards in accordance with the PDPA (e.g. standard contractual clauses).

Sign-in via Google, Apple, Facebook and LINE: Instead of using their email address, guests may also sign in with an existing account with one of the following providers, where SiamPoints offers this option: Google (Google LLC, USA; for users in the European Economic Area, Google Ireland Limited, Ireland), Apple (Apple Inc., USA; in Europe, Apple Distribution International Limited, Ireland), Facebook (Meta Platforms, Inc., USA; in Europe, Meta Platforms Ireland Limited, Ireland) and – in Thailand only – LINE (LY Corporation, Japan). You will be redirected to the respective provider and enter your password there only; SiamPoints never receives it. With your consent, the provider transmits to us only a unique identifier of your account, your name, your email address and whether this email address has been verified (with Apple, possibly a relay address if you choose “Hide My Email”). We use this data solely to sign you in, to recognize your account and to avoid duplicate accounts – never for advertising. With LINE and Facebook, you additionally confirm your email address with a code from us before we link the account. We do not obtain access to your contacts, friend lists, posts or messages and do not send any messages via this sign-in (for messages from businesses, see section 3). During sign-in, the respective provider processes your data in accordance with its own privacy policy and, where applicable, outside Thailand, in particular in the USA, the European Union or Japan. The legal basis is the performance of the contract (section 2.1); for transfers abroad, we ensure appropriate safeguards in accordance with the PDPA. You may remove the link at any time in the settings of your account with the provider or request the deletion of your SiamPoints account (section 7); sign-in by email remains available to you at all times.

1.4 Other functions and data

• Address search, maps and location: When you type a search term into an address field, we pass it on via our platform to our service provider Geoapify, which suggests matching addresses with coordinates; we do not pass on your IP address in the process. We store the coordinates of establishments for the map and the nearby search. Maps load their map images from OpenFreeMap or Geoapify; in doing so, the provider receives your IP address — as with any request for a web page — but does not set any cookies. For the nearby search, we use your location only if you share it in your browser, and only for that search; we never store it. This applies equally to guests and sales partners.

• Media: We may store and deliver the public media of businesses and of our website (such as logos, photos, menus, flyers and videos) via Cloudflare (R2 storage and content delivery network). We do not store documents, payment slips or guest data there.

• Reports: If you report an establishment, a piece of content or a message — with the “Report this business” button, the “Report content” link or by email to [email protected] —, we store your report (reason, description, content concerned), your contact details and the history of how it was handled, in order to acknowledge receipt, ask follow-up questions and look into the report.

• Support: For support requests, we store the category, subject, text, attachments, the history including our replies and your rating of the reply.

• Sales partners: For promoters as well as business and promotion partners, we store their first and last name or company name, contact details, their partner code and link, the prospective customers they report (section 1.1) and the basis for their commission; before the first payout, the 13-digit number of the Thai national ID card or the company’s tax ID, the address and the bank details; in addition, the payouts, the deduction of withholding tax and the withholding tax certificates (50 Tawi). Sales partners do not undergo any identity check using biometric data. Details are set out in the Partner Terms.

• Associations and partner companies: For associations and partner companies, we store the name, address, tax ID, contact person, bank details and, on a voluntary basis, an email address for the monthly statement of their commission (section 4), together with the statements, the payouts, the deduction of withholding tax and the withholding tax certificates (50 Tawi). Details are set out in the Terms for Associations & Partner Companies.

2. Purposes of Processing and Legal Bases

Under the PDPA, we process your personal data only where a valid legal basis exists.

2.1 Performance of a contract (contractual basis)

• To set up and manage the SiamPoints merchant account and staff logins.

• To set up and manage guests’ accounts, for sign-in and for crediting and redeeming points.

• To provide the SaaS infrastructure (loyalty points system, reservation engine, e-commerce shop).

• To process orders, deliveries and payments (including bank and PromptPay transactions) between guest and business.

• Not a payment service provider: SiamPoints is not a payment service provider. We do not accept payments on behalf of businesses or guests, do not hold any money and do not forward any: guests’ payments always go directly to the business, and the business pays its subscription directly to SiamPoints. For electronic payments, we merely pass on the transaction data technically to the payment service provider or verification service.

• To invoice the subscription, booked advertising and orders from the promotional materials shop — including the checking of payment slips — and to calculate and pay out the commissions of sales partners, associations and partner companies.

• To handle support requests.

2.2 Legitimate interest

• For the technical provision, security and optimization of the platform (e.g. fraud prevention, IT security), including the logs of save actions and the handling of reports.

• B2B communication: For acquisition, account management and technical support, we contact our business partners (businesses/shops) by mobile phone, email, LINE and, where applicable, WhatsApp.

2.3 Legal obligation

• To comply with retention obligations under tax and commercial law and to store IT logs (traffic data) in Thailand.

• To handle reports and notices from authorities (among others under the Royal Decree on the Operation of Digital Platform Service Businesses that are Subject to Prior Notification, B.E. 2565 and the Computer Crimes Act) and to disclose data to authorities and courts upon lawful request.

• To issue receipts and tax documents, to deduct withholding tax from commissions and to issue withholding tax certificates (50 Tawi).

2.4 Consent

• Where we process data beyond what is required for the performance of the contract, we obtain your express consent in advance — for example for the identity check using biometric data and for sharing your location in your browser. You give your consent to messages from a business (broadcasting) to that business; we store the proof on its behalf.

3. Principle of Strict Purpose Limitation and No Advertising (Guests)

SiamPoints is committed to handling end customer data transparently and economically. SiamPoints sends no broadcast messages, newsletters or advertising communications of any kind to guests. We use guests’ data exclusively for the technical processing of the transactions requested by the guest (crediting of points, reservation, order). The participating businesses are likewise instructed by our Terms of Use not to misuse guest data collected via SiamPoints for unsolicited advertising purposes.

Guests receive advertising messages from a business only if they have expressly consented to this with that business for the service concerned (broadcasting). The business sends them via its own account with that service (in Thailand, LINE) and is solely responsible for them (Broadcasting Terms); SiamPoints processes the data only on the business’s behalf (Data Processing Agreement (DPA)). Every message ends with an unsubscribe line that takes effect immediately; in your account, you can switch off messages at any time, either entirely or per business and service. From SiamPoints itself, guests receive only the emails required for their account (such as sign-in codes and links).

4. Disclosure of Personal Data and International Transfers

We do not sell your data. Data is disclosed only within the following scope:

• Between guest and business: The data entered by the guest (e.g. delivery address, reservation details) is transmitted to the specific business with which the guest books or shops. For this data — such as reservations, orders, feedback, payment slips, information in the business’s own form fields and consents for broadcasting — the business is the data controller; SiamPoints processes it on the business’s behalf under our Data Processing Agreement (DPA). A business sees a guest’s phone number only if the guest enters it for a delivery, and only on that order. Of a business, guests see only what it publishes for guests itself (such as the name of the establishment, its location and its offers) and, for purchases and online payments, the seller — never the contact details of the owner and their employees, the tax ID or the documents.

• Sales partners, associations and partner companies: For their commission, a sales partner learns which of the establishments they referred have registered and what these have paid; an association or partner company learns the names of the establishments registered with its code and the amount of their subscription. They do not receive any guest data.

• Service providers (data processors) and international transfers: We use external technical service providers (e.g. for cloud hosting, server infrastructure, content delivery networks, security networks, LINE Messaging API integrations) that are strictly bound by our instructions and by the PDPA. As some of our IT infrastructure providers operate servers outside Thailand, data may be transferred internationally. We ensure that these recipient countries or providers have adequate data protection standards that meet the requirements of the PDPA.

• Our service providers in detail: Cloudflare (protection against attacks and bots, delivery and storage of public media), IPinfo (fraud prevention), Stripe and Opn Payments/Omise (subscription payments by card or PromptPay), SlipOK, EasySlip or Thunder (checking of payment slips — for the subscription via our account, for guests’ payments via the business’s own account), Geoapify and OpenFreeMap (address search and maps), Sumsub (identity checks in industries with a particular risk), Google, Apple, Meta and LY Corporation (sign-in), as well as providers of data centers and email delivery. For broadcasting, a business uses its own account with the respective service — in Thailand LINE (LY Corporation) and, where SiamPoints offers further services, also WhatsApp, Facebook Messenger or Instagram (Meta) or Viber; the service’s terms apply to that account, and the business is responsible for it. Some of these service providers process data outside Thailand, for example in the USA, the European Union, the United Kingdom or Japan; here, too, we ensure appropriate safeguards in accordance with the PDPA.

• Authorities: Only where we are obliged to do so by law or by an official order under Thai law. This includes, upon lawful request, the logs under Section 26 of the Computer Crimes Act (section 5).

5. Data Storage and Retention Periods

We store personal data only for as long as is necessary to fulfill the purposes set out in this Privacy Policy:

• Business partner data: For the duration of the contractual relationship. After the subscription has ended — and likewise during a suspension for non-payment, including after a trial without payment — we retain all data of the establishment, including all media, for six months so that the owner can reactivate the subscription; we send reminders by email 30 days and 7 days before deletion. After that, we irrevocably delete the establishment’s data and media; the account itself remains until the owner requests its deletion. Details are set out in the Subscription Terms. We retain invoices, receipts, payment slips, withholding tax certificates and other accounting records for up to 10 years in order to comply with Thai accounting and tax laws (Revenue Code).

• Guest data: For as long as the loyalty account is active or until the guest requests the deletion of their data. Transaction data (purchases/reservations) is retained for the respective business in accordance with statutory requirements. Data that we process on behalf of a business is handled in accordance with its instructions and with clause 3.5 of our Data Processing Agreement (DPA); guests’ points are preserved even if an establishment’s data is deleted.

• Technical logs: Generally stored for 90 days in order to comply with the requirements of the Thai Computer Crimes Act.

• Logs, reports and authorities: We retain the logs of businesses’ save actions (time, type, establishment, IP address), reports and how they were handled, suspensions and correspondence with authorities for 2 years so that we can answer requests under Section 26 of the Computer Crimes Act.

• Broadcasting: proof of consent until 2 years after its withdrawal; the logs of messages sent for 2 years.

• Fraud prevention: the information from the check via IPinfo for 12 months (section 1.3).

• Support: closed support requests generally for 24 months.

• Prospective customers: If no contract results from a contact, we delete the details after 12 months.

• Sales partners, associations and partner companies: for the duration of the cooperation; statements, payouts and withholding tax records for up to 10 years.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, manipulation or destruction. These include encryption technologies (SSL/TLS), secure server infrastructures, strict access controls for databases and regular security reviews. Documents, payment slips and attachments to support requests can be accessed only by authorized persons, and our staff see data only to the extent their tasks require.

7. Your Rights under the Thai PDPA

As a data subject, you have the following rights under the PDPA:

• Right to access: You may request a copy of your data stored by us.

• Right to rectification: You may request the correction of incomplete or inaccurate data.

• Right to erasure (“right to be forgotten”): You may request that we delete your data, provided that no statutory retention obligations prevent this.

• Right to restriction of processing: Under certain conditions, you may request that the processing of your data be suspended.

• Right to data portability: You have the right to receive your data in a machine-readable format.

• Right to object: You may object to the processing of your data (e.g. on the basis of legitimate interest).

• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time with effect for the future.

• Right to lodge a complaint: You may lodge a complaint with the Thai data protection authority (Personal Data Protection Committee – PDPC) if you believe that we are in breach of the PDPA.

Guests can also delete their data themselves: under “My account” with “Delete my data”. For anything else, an email to us is enough (section 8).

Note for guests: If you request the deletion of your data, any loyalty points you have collected will be forfeited without replacement, as we can no longer allocate them without your account.

8. Contact Details of the Data Controller

If you have any questions about this Privacy Policy or wish to exercise your rights under the PDPA, please contact us at:

First Class Tech Ventures Co., Ltd., 352/951 Moo 12, Nong Prue, Bang Lamung, Chonburi 20150, Thailand. Email: [email protected]

Please send reports of content and requests from authorities to [email protected].

We will handle your request within the statutory time limits of the PDPA (generally within 30 days).