Customer Privacy Notice

Universal Food Public Company Limited (the “Company“) wishes to inform you of this Customer Privacy Notice (the “Notice“) as a customer who contacts the Company for information and/or purchases the Company’s product or uses the Company’s OEM service via the Company’s sales and distribution channels both online and offline (the “Customer“), so that the Customer shall acknowledge the necessity and conditions of the Company to process their personal data. This Notice defines the Company’s rights, conditions, and necessity for collecting, processing, and using your personal data. Once the Customer contacts and/or purchases the Company’s product or service including providing your personal data to the Company, the Company shall deem that the Customer has agreed and accepted this Notice.

This Notice shall only apply to the processing of personal data in the direct contact and/or purchase of product or use of the Company’s service and shall not apply to the processing of personal data by other third parties that are beyond the Company’s control, even if their operation and/or service is connected to the Company’s services (including but not limited to processing of the Customer’s personal data by (i) the Company’s distributor responsible for distributing and delivering the products to the Customer, or (ii) the Online Marketplace service provider). For such third-party processing of personal data, the Customer must read and agree to each privacy notice announced separately by those third parties.

The Company reserves the right to amend this Notice from time to time in order to ensure compliance with applicable laws and the communication channel, sale process, product delivery, and any service provision that the Company may provide to the Customer; provided that the Company shall notify the Customer of such an amendment via the Company’s communication channels. 

Processing of Personal Data of the Customer

The Company would like to inform the Customer that the Company may receive the Customer’s personal data (1) directly from the Customer or (2) from a third party service provider providing the service relating to the sales of the Company’s goods and services (including but not limited to the Marketplace service provider), which is a third party.

The Company need to collect, compile, and process the Customer’s personal data as follows:

1. General information about the Customer, i.e., full name and contact information (email and phone number); and, in the case of a corporate customer, the authorized person or employee (the “Corporate Customer’s Representative“), including the Customer’s social media accounts, such as Facebook and LINE accounts;
2. Delivery information (in the case of an online purchase channel) specifically, the Customer’s delivery address;
3. Identification information of the Customer or Corporate Customer’s Representative (in the case of a tax invoice or any attachment relating to sales of products or OEM service, etc.);
4. Information regarding the purchase of a product by the Customer, such as a list of transactions, product details, etc., which may include payment information made to the Company, such as proof of payment, bank account, or credit card information, etc.; 
5. Technical information that the Company’s systems use to identify the Customer, such as the IP address and any other information tools used by the Customer to access the Company’s online sales channel and website;
6. Any other personal data that the Customer may provide to the Company during the communication between the Company and the Customer (including but not limited to Customer complaints and comments) or Customer’s personal data that the Customer allows or provides to the Company for processing. 

Objective of Personal Data Processing

The Customer’s personal data shall be collected, used, and processed by the Company for the following purposes:

1. For contract preparation and performance of any rights and obligations the Company may have with the Customer under the agreement: The Company needs to process the personal data in order to (1) enter into a sales and purchase agreement or any documents related to the hire of work service (2) performance of any duties between the Company and the Customer relating to sales of goods or hire of work services, including order confirmation, Customer’s identity verification, payment confirmation, and delivery services. For this purpose, it is necessary for the Company to process the Customer’s personal data for as long as the Company still has obligations to perform for the Customer under the sale and purchase or hire of work agreements;
2. For communication with the Customer: (including answering questions, managing complaints or comments), the Company needs to process the Customer’s personal data only for the period of time necessary to the Company for this purpose;
3. For the Company’s legal obligations, such as preparing accounting and taxation documents and in case the Customer requests a tax invoice from the Company, it is necessary to collect, compile, and retain the Customer’s personal data for the period of time specified by applicable laws;
4. For creating and improving business relationships with the Customer: including risk management, data analysis, service improvement, product design, and the arrangement of Customer’s group for market strategy planning and advertising. The Company guarantees the personal data will be used only for this purpose and that the Company will not violate your rights as the data subject excessively;
5. For protection of the Company’s legitimate rights in enforcement of their claims and rights: between the Company and the Customer. The Company needs to retain the Customer’s personal data for 1 year after the Customer’s last purchase;
6. In case the Customer gives consent to the Company: specifically, to contact and advertise, which includes but not limited to sending product information that is in the Customer’s interest via communication channels. The Company may use the Customer’s personal data to inform the Customer of any promotion, event, or marketing until such consent is withdrawn.

Disclosure of Personal Data  

Generally, the Company will not disclose the Customer’s personal data to any third party. However, the Company may be necessary to disclose and/or share the Customer’s personal data to the following persons:

1. To third-party service providers that the Company may engage (1) for supporting the Company’s services relating to sales and purchase and delivery of products to Customer including but not limited to the local and global distributor; logistic provider; payment gateway service provider; and (2) for support of the Company’s business operations, including but not limited to the Company’s consultants; provided that the Company shall disclose the information on a necessary basis under the data processing agreement between the Company and such third-party service providers;
2. To relevant government authorities that the Company is obliged under the relevant laws or orders to disclose the Customer’s personal data to, including the Revenue Department;
3. To other persons that the Customer gives explicit consent to the Company to disclose your personal data to.

Company’s Representations to Implement Appropriate Information Security Measures

The Company warrants that it will implement appropriate information security measures in accordance with applicable laws to prevent unauthorized access, use, amendment, or disclosure of the Customer’s personal data. The Company commits to periodically review the information security measures to ensure compliance and suitability with the best industrial standards and changes in the applicable laws.

Data Subject’s Rights over their Personal Data

The Company respects the Customer’s statutory rights as the data subject with regard to their personal data under the Company’s control. The Customer can request to exercise their rights under the applicable laws as follows: 

(1) The right to withdraw consent

(2) The right to request access to or a copy of their personal data

(3) The right to revise their personal data

(4) The right to request data portability

(5) The right to object to any processing of their personal data

(6) The right to request deletion or de-identification of their personal data once no longer required

(7) The right to request the suspension of processing of their personal data.

Please feel free to contact the Company if you have any queries regarding this Notice or if you would like to request to exercise any of those defined rights. The Company will notify you of its consideration of such a request within the time frame prescribed by law. Please contact us at 

Data Protection Officer

Email : ufc.dpo@ufc.co.th