Privacy Policy Card X Company Limited

Version July 2026

We, Card X Company Limited (“Company” or “we” or “our”), care about your privacy; thus, we provide this Privacy Notice to inform our customers (“you” or “your”) of our policy in relation to the collection, use and disclosure of your personal data in accordance with the Personal Data Protection Act B.E. 2562 and any amendment thereof (“PDPA”), relevant laws and regulations. This is to inform you of how we collect, use or disclose your personal data, what and why we collect, use or disclose your personal data, how long we hold it, whom we disclose it to, your rights, what steps we will take to make sure your personal data stays private and secure, and how you can contact us.
 

This Privacy Notice applies to:

(1) Our customers

• Individual customers: Customers who have products or services with the Company, including former and existing customers, and who are individual.
• Corporate customers: Directors, shareholders, ultimate beneficial owners, employees, security providers, and legal representatives of our corporate customers and other individuals authorised to act on their behalf. Our corporate customer shall ensure that the authorised persons and any of relevant individuals have acknowledged our Privacy Notice.

(2) Non-customers

These include individuals who have no product or service  with us, but we may need to collect, use or disclose your personal data (e.g., directors, investors; anyone who makes a payment to or transfer money to or receives a payment from our customers; anyone that visits our website or our applications, branches or offices; security providers; beneficiaries under insurance policy; ultimate beneficial owner; directors or legal representatives of a company that uses our services; professional advisors, including directors, investors, shareholders and their legal representatives, and anyone involved in other transactions with us or our customers). 

Please note that if some of the links on our platform may lead to third party’s platforms, and if you access these platforms, your personal data will then be processed under the third party’s policies. Under these circumstances, please make sure that you have read those privacy notices when accessing such platforms.

1. How we collect, use or disclose your personal data

We only collect, use or disclose your personal data where it is necessary or there is a lawful basis for collecting, using or disclosing it. This includes where we collect, use or disclose your personal data based on the legitimate grounds of legal obligation, performance of contract made by you with us, our legitimate interests, performance under your consent and/or other lawful basis. Reasons for collecting, using or disclosing the personal data are provided below:

1.1 Our legal obligation

We are regulated by many laws, rules, regulations, and orders of any competent governmental, supervisory or regulatory authorities, and to fulfil our legal and regulatory requirements, it is necessary to collect, use or disclose your personal data for any or more of the following purposes, without limitation: 

a) compliance with the PDPA ;

b) compliance with laws (e.g., Financial Institution Business Laws, Anti-Money Laundering Laws, Prevention and Suppression of Financial Support to Terrorism and the Proliferation of Weapons of Mass Destruction Laws, Life and Non-life Insurance Laws and other laws to which we are subject both in Thailand and in other countries), including conducting identity verification, background checks and credit checks, Know Your Customer (KYC) process, Customer Due Diligence (CDD) process, other checks and screenings (including screening against publicly available database of regulatory authorities and/or official sanctions lists), and ongoing monitoring that may be required under any applicable law; and/or

c) compliance with regulatory obligations and/or orders of authorized persons (e.g. orders by any court of competent jurisdiction or of governmental, supervisory or regulatory authorities or authorized officers). In the case which we are acting as an insurance broker, we will disclose your personal data to Office of Insurance Commission for the purposes of regulating and promoting the insurance business in accordance with Insurance Commission Act, Life Insurance Act and/or Non-Life Insurance Act. Please further read Privacy Policy of Office of Insurance Commission at www.oic.or.th. In addition, if you do not wish to be contacted for any insurance-related offer, or you refuse the insurance-related offer from us, or you are not interested in insurance product(s) offered by us, we will disclose your name, the date on which you inform us that you do not wish to be contacted for the insurance-related offer, or you refuse the insurance product(s) offer by us, or you are not interested in such insurance, and/or any other data determined by Office of Insurance Commission to insurance company in order for the insurance company to record and not to offer any insurance-related products to you for a period determined by Office of Insurance Commission.

1.2 Contract made by you with us

We will collect, use or disclose your personal data in accordance with the request and/or agreement made by you with us, for any or more of the following purposes, without limitation :

a) To process your request prior to entering into an agreement, consider for approval and execute transactions of provide products and/or services, and deliver products and/or services to you, provide advice and deal with all matters relating to products and/or services, including any activities that if we do not proceed, then our operations or our services may be affected or may not be able to provide you with services fairly and continuously;

b) To verify your identity when you are entering into, doing or executing any transactions (e.g. sending your identification card data to the Department of Provincial Administration for verifying the status of your identification card);

c) To carry out your instructions (e.g., processing your applications and/or your transactions, fulfilling a request for execution of transactions or utilization of products and/or services, responding to your enquiries or feedbacks, or resolving your complaints), including but not limited to recording images, videos and/or voices and/or any similar actions to enable us to efficiently carry out your instructions and/or keeping record as evidence for proceeding with your instructions;

d) To provide websites, mobile applications and other online product platforms;

e) To track or record your transactions;

f) To produce reports (e.g., transaction reports requested by you or our internal reports);

g) To notify you with transaction alerts and notify the due date of products and/or services;

h) To collect your outstanding debt (e.g., when you have not made repayment(s) for your past due loan debt, credit card debt and/or fees);

i) To carry out account maintenance and operations relating to your user accounts and/or financial accounts, including but not limited to processing your applications or requests for services or products, processing your transactions, generating statement of your user accounts and/or financial accounts, and operating and closing your user accounts and/or financial accounts;

j) To carry out or make transactions and/or payments (e.g., processing payments or transactions, fulfilling transactions, billing or processing activities, managing your relationship with us, and administering your account with us);

k) To proceed with any acts relating to insurance policy (e.g., proceeding with or monitoring any claim under your insurance policy, claiming against third party);

l) To enforce our legal or contractual rights;

m) To provide IT and Helpdesk supports, create and maintain codes and user accounts for you, manage your access to any systems to which we have granted you access, and remove inactive accounts; and/or

n) To disclose and transfer your personal data to one or more third parties who are the transferees of claims, assets, debt, or business, or the parties involved in the merger or reorganizing, or the plan preparers and plan administrators, or those related to such similar event in the case of sale or transfer of claims, assets, debt or business, merger, reorganization, rehabilitation, or similar event.

1.3 Our legitimate interests

We rely on the basis of legitimate interests by considering our benefits or third party’s benefits against your fundamental rights over the personal data which we will collect, use or disclose for any or more of the following purposes, without limitation:

a) To conduct our business operations and the business operations of companies within SCBX Group as specified in https://www.scbx.com/en/affiliates-financial-business-group/ and of SCBX Group (e.g., to govern, to audit, to conduct risk management in business operations and internal management, to manage and audit financial and accounting, to conduct information technology and cybersecurity management, to conduct procurement management, to conduct human resource management, to define guidelines and strategic planning for operations, to conduct debt restructuring and manage the risks of customers of the companies in SCBX Group, to monitor, prevent, and investigate fraud, money laundering, terrorism, misconduct, or other crimes, including but not limited to carrying out the creditworthiness checks of any persons related to our corporate customer, which may not be required by any governmental or regulatory authorities, and authenticating your identity to prevent such crimes);

b) To conduct our relationship managements (e.g., to serve and facilitate you, to conduct survey, to manage customer segmentation, to handle complaints, to coordinate with relevant persons) including recording images, videos and/or voices and/or any similar actions to enable us to efficiently conduct our relationship managements and/or to enhancing our services;

c) To ensure security (e.g. to maintain CCTV records, to register, exchange identification card and/or take photos of visitors before those enter into our building areas);

d) To develop and improve our products, services and systems to enhance our services standard, and to use your personal data for conducting credit modelling, and/or for the greatest benefits in fulfilling your needs, including conducting research, analysing data and offering products, services and benefits suitable to you by considering the fundamental rights in your personal data. If you do not wish to receive the offering of products, services and benefits from us, you can contact us, details as specified in Clause 11;

e) To record images, videos and/or voices relating to the meetings, trainings, seminars, recreations or activities (e.g., marketing activities, corporate social responsibility activities, activities to support customer’s business) and to use such recorded images, videos and/or voices for the purpose of making public relations relating to such meetings, trainings, seminars, recreations or activities, whether internally or externally;

f) To collect, use and disclose personal data of directors, authorized persons or attorneys in the case of our corporate customer;

g) To ensure business continuity;

h) To handle claims and disputes, to file lawsuits and to process the relevant legal proceedings;

i) To contact you prior to your entering into a contract with us;

j) To protect against security risks (e.g. monitoring network activity logs, detecting security incidents, conducting data security investigations, and otherwise protecting against malicious, deceptive, fraudulent, or illegal activity);

k) To comply with applicable foreign laws;

l) To analyze, carry out research, plan and conduct statistical analysis (e.g. data analytics, assessments, surveys and preparations of reports on our products and/or services and your behavior, usage location and usage history);

m) To organize our promotional campaigns or events, conferences, seminars, and company visits;

n) To facilitate financial audits to be performed by auditors;

o) To receive advisory services from legal counsels, financial advisors, and/or other advisors appointed by you or us;

p) To disclose and transfer your personal data to one or more third parties as part of that transaction in the event of any contemplated or proposed sale, transfer, merger, reorganization, or similar event, or if such action is contemplated;

q) To maintain and update lists and directories of the customers (including your personal data) and to keep contracts and associated documents in which you may be referred to; and/or

r) To comply with reasonable business requirements (e.g. management, training, auditing, reporting, control or risk management, statistical and trend analysis and planning or other related or similar activities, implementing business controls to enable our business to operate, and enabling us to identify and resolve issues in our IT systems to keep our systems secured, performing our IT systems development, implementation, operation and maintenance).

1.4 Your consent

In certain cases, we may ask for your consent to collect, use or disclose your personal data to maximise your benefits and/or to enable us to execute transactions or provide services to fulfil your needs for any or more of the following purposes, without limitation: 

a) To collect, use or disclose your sensitive personal data as necessary e.g. to use facial recognition or your identification card photo (which contains your sensitive personal data, namely religion and/or blood type) for verification of your identity before you continue the transaction and for Know Your Customer (KYC)process;

b) To collect and use your personal data for the purpose of offering products, services and benefits suitable to you, To proceed with such activity, the Company will research, conduct statistical data, analyze or develop products, services and benefits (in the case where consent is required under the PDPA);

c) To contact you to provide financial advice and offer our products, or services, and benefits in which you may be interested (in the case where the consent is required under the PDPA);

d) To disclose your personal data and any other data to companies within SCBX Group as shown on https://www.scbx.com/en/affiliates-financial-business-group.html and our trusted business partners for the purpose of offering or providing products, services and benefits to you. To proceed with such activity, companies in SCBX Group and our trusted business partners will research, conduct statistical data, analyze or develop products, services and benefits suitable to you;

e) To disclose your personal data and any other data to companies within SCBX Group as shown on https://www.scbx.com/en/affiliates-financial-business-group.html for the purpose of analyzing, carrying out the research, and preparing the statistical data, details of which will be beneficial in providing services more efficiently and suitably for you;

f) To send or transfer your personal data and sensitive personal data overseas at the location, where may have inadequate personal data protection standards (unless the PDPA specifies that we may proceedunder other lawful basis or without obtaining consent);

g) when you are classified as a minor, incompetent or quasi-incompetent whose consent must be given by their parent, guardian or curator (as the case may be)(unless the PDPA specifies that we may proceed without obtaining consent); and/or

h) To proceed with any other activities which we must require your consent.

1.5 Other lawful basis

Apart from the lawful basis mentioned earlier, we may collect, use or disclose your personal data based on any or more of the following grounds on a lawful basis:

a) To prepare historical documents or archives for the public interest, or for purposes relating to research or statistics;

b) To prevent or suppress a danger to a person’s life, body or health; and/or

c) To be necessary to carry out a public task, or for exercising the competent officer’s authority.

If the personal data we collect from you is required to meet our legal obligations or to enter into an agreement with you, we may not be able to execute transactions with you or to provide (or continue to provide) some or all of our products and services to you if you do not provide such personal data when requested.

In addition, the Company may utilize technologies currently possessed or to be acquired in the future for the collection, use, or disclosure of your personal data in accordance with the purposes stated in clauses 1.1 – 1.5 above, including, but not limited to, Artificial Intelligence (“AI”), Generative AI Usage, such as AI Chatbot technology, Cloud Computing, etc.

Furthermore, the Company may establish the system(s) and/or use the shared system(s) to support operations and business activities for shared use within SCBX Group and may collect, use, or disclose your personal data held by the Company and the companies in SCBX Group through such system(s) in accordance with the PDPA.

2. What personal data we collect, use or disclose

The type of personal data, namely personal data and sensitive personal data, which we collect, use or disclose, varies on the scope of transactions, products and/or services that you may use or be interested in. The type of personal data and sensitive personal data shall include but not limited to:

3. Sources of your personal data

Normally, we will collect your personal data directly from you, but sometimes we may get it from other sources, in such case we will ensure the compliance with the PDPA. 

Personal data we collect from other sources may include but not limited to:

a) Data obtained by us from companies within SCBX Group, business partners, and/or any other persons whom we have legal relationship with;

b) Data obtained by us from persons related to you (e.g. your family, friends, referees);

c) Data obtained by us from corporate customers as you are director, authorised person, attorney, representative or contact person;

d) Data obtained by us from governmental authorities, regulatory authorities, financial institutions, credit bureau and/or third-party service providers (e.g., publicly available data, transaction-related data, credit data); and/or

e) Data obtained by us from insurance companies and/or other persons in relation to the insurance policy or claim for compensation.

In the case you have given any personal data of any other person to us for executing transactions with us or any purposes, you shall notify such person of the details relating to the collection, use and disclosure of personal data and rights under this Privacy Notice. In addition, you shall obtain consent from such person (if necessary) or rely on another legal basis to provide the personal data to us.

4. Your rights

The PDPA aims to give you more control of your personal data. You can exercise your rights under the PDPA, with the details as specified below, through the channels determined by us: 

4.1 Right to access and obtain copy

You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.

4.2 Right to rectification

You have the right to rectify your inaccurate personal data or to update your incomplete personal data.

4.3 Right to erasure

You have the right to request us to delete, destroy or anonymise your personal data, unless there are certain circumstances where we have the legal grounds to reject your request.

4.4 Right to restrict

You have the right to request us to restrict the use of your personal data under certain circumstances (e.g., when we are in the process of examining your request to rectify your personal data or to object the collection, use or disclosure of your personal data, or you request to cease the use of personal data instead of the deletion or destruction of personal data which is no longer necessary as you have necessity to retain it for the purposes of claim, compliance, exercise or counterstatement).

4.5 Right to object 

You have the right to object the collection, use or disclosure of your personal data in case we proceed with legitimate interests basis or for the purpose of direct marketing, or for the purpose of scientific, historical or statistic research, unless we have legitimate grounds to reject your request (e.g. we have compelling legitimate ground to collect, use or disclose your personal data, or the collection, use or disclosure of your personal data is carried out for the claim, compliance, or legal claims exercising, or for the reason of our public interests).

4.6 Right to data portability

You have the right to receive your personal data in case we can arrange such personal data in readable format or any format commonly used by ways of automatic tools or device, and can be used or disclosed by automated means. Also, you have the right to request us to send or transfer your personal data to third party, or to receive your personal data which we sent or transferred to third party, unless it is impossible to do so because of the technical circumstances, or we are entitled to legally reject your request.

4.7 Right to withdraw consent

You have the right to withdraw your consent that has been given to us at any time pursuant to the methods and means determined by us, unless the nature of consent does not allow such withdrawal. The withdrawal of consent will not affect the lawfulness of the collection, use, or disclosure of your personal data based on your consent before it was withdrawn.

You can review and change your consent to use or disclose your personal data for marketing purposes through channels as specified in Clause 11 hereof or through Card X Application or other channel determined by us in the future.

4.8 Right to lodge a complaint 

You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA. 

5. How we share your personal data

We may disclose your personal data to any or more of the following parties under the provisions of the PDPA:

a) companies within SCBX Group, business partners and/or other persons that we have the legal relationship, including our directors, executives, employees, staffs, contractors, representatives, and/or advisors as well as those persons’ directors, executives, employees, staffs, contractors, representatives and/or advisors;

b) governmental authorities and/or supervisory or regulatory authorities (e.g., the Bank of Thailand, Ministry of Digital Economy and Society, Anti-Money Laundering Office, Office of Insurance Commission, Thai Revenue Department, Department of Provincial Administration);

c) suppliers, agents and other entities (e.g. professional associations to which we are member, external auditors, document warehouses, overseas financial institutions, clearing houses) where the disclosure of your personal data has a specific purpose under lawful basis, as well as appropriate security measures;

d) any relevant persons as a result of activities relating to transfer of rights and/or assets, restructuring or acquisition of any of our entities, where we may transfer their rights to; any persons whom we are required to share data with, for such a transfer, reorganisation, business transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets used for our business operations;

e) other banks, financial institutions and third parties where required by law to help those persons to recover the funds wrongly transferred to your account or trace funds where you are a victim of fraudulently financial crime, or where suspicious funds have been transferred to your account as a result of financial crime;

f) debt collection agencies, lawyers, credit bureau, fraud prevention agencies, courts, authorities or any persons whom we are required or permitted by laws, regulations, or orders to share personal data with;

g) third parties providing services to us (e.g., IT service providers, market analysis and benchmarking service providers, cloud computing service providers, including but not limited to correspondent banking, overseas remittance system service providers and switching system service providers, agents or subcontractors acting on our behalf, the service providers for printing and delivering credit card statements);

h) social media service providers (in a secure format) or other third-party advertisers so that they can display relevant messages to you and others on our behalf about our products and/or services, provided that the third-party advertisers may also use the data relating to your previous online activities to tailor advertising you might be interested in;

i) third-party security providers;

j) other persons that provide you with relevant benefits or services associated with our products or services (e.g., insurance company); and/or

k) your attorney, sub-attorney, authorized persons or legal representatives who have lawfully authorized power.

6. International transfer of personal data

Due to the nature of our business to provide the services globally and under certain circumstances it is necessary for us to send or transfer your personal data internationally (e.g. transferring data to companies within SCBX Group or to cloud server overseas for the purpose of the provision of services). When sending or transferring your personal data, we will always exercise our best effort to have your personal data transferred to our reliable business partners, service providers or other recipients by the safest method in order to maintain and protect the security of your personal data.

In the event that the destination country does not have adequate personal data protection standards, we will ensure that the sending or transfer of your personal data complies with the requirements of the PDPA and will implement measures for personal data protection deemed necessary and appropriate to ensure that your personal data is protected under the standards equivalent to those in Thailand, such as entering into agreements with the data recipient, details of which contain contractual obligations to maintain the personal data protection with adequate security standards.  

7. Retention period of personal data

We will maintain and keep your personal data for a period of time that is appropriate and necessary for each type of personal data and for the purposes as specified by the PDPA and other applicable laws, including but not limited to the anti-money laundering law. In this aspect, the aforesaid period will be managed within the prescription required by and in accordance with the applicable laws (e.g., Financial Institutions Businesses Law, Anti-Money Laundering Law, Counter-Terrorism and Proliferation of Weapon of Mass Destruction Financing Law, Accounting Law, Tax Law, Labour Law and other laws to which we are subject both in Thailand and in other countries). In addition, we may need to retain records of CCTV surveillance installed at our premises and/or voice recordings of services provided through Card X Contact Center and/or bank branches and/or ATMs used by you, for the purposes of preventing fraud and ensuring the security, including investigating suspicious transactions of which you or related persons may inform us.

8. Use of Cookies

We may collect and use cookies and similar technologies when you use our products and/or services. This includes when you use our websites and applications.

The collection of such cookies and similar technologies helps us to recognise you, remember your preferences and customise how we provide our products and/or services to you. We may use the cookies for a number of purposes (e.g., enabling and operating basic functions, helping us to understand how you interact with our websites or emails, or enabling us to improve your online experiences or our communications with you, particularly, to ensure that online adverts displayed to you will be more relevant to you and of your interests). For details please see our  Cookie Notice.

9. Use of personal data for original purposes

We are entitled to continue collecting and using your personal data, which has previously been collected by us before the effectiveness of the PDPA in relation to the collection, use and disclosure of personal data, in accordance with the original purposes. If you do not wish us to collect and continue  using your personal data, you may notify us to withdraw your consent at any time.

10. Security

We endeavour to ensure the security of your personal data through our internal security measures and strict policy enforcement. The measures extend from data encryption to firewalls. We also require our staff and third-party contractors to follow our applicable privacy standards and policies and to exercise due care and proper measures when using, sending or transferring your personal data. 

11. How to contact us

If you have any questions or would like more details about our Privacy Notice, please contact us through the following channels:

• Card X Company Limited

our head office located at 9 Rutchadapisek Road, Chatuchak, Chatuchak, Bangkok 10900.

• Our Data Protection Officer

via E-mail: dpo@cardx.co.th or our address as specified above.

If you would like to exercise your rights in accordance with PDPA, please contact us through address indicated above or Card X Contact Center Tel.1468.

12. Changes to this Privacy Notice

We may change or update this Privacy Notice from time to time, and we will inform you of the updated Privacy Notice via at our website http://www.cardx.co.th