Privacy Notice

This Privacy Notice (“Notice”) is prepared to explain to you, as a data subject, the principles and methods by which we, True Corporation Public Company Limited and its affiliates as listed in Section 1 (“the Company” or “True”), collect, use, or disclose your personal data, as well as your legal rights as a data subject.
This Notice demonstrates the Company’s commitment to respecting your privacy and to managing your personal data responsibly, securely, and ethically. This Notice covers the following:

1. An explanation of how we collect, use, and disclose your personal data when you contact the Company or use our goods, services, products, websites, or applications.
2. The purposes, principles, and methods for processing your personal data.
3. A description of the types of personal data the Company collects and the circumstances under which we may disclose that data to third parties.
4. Information on your legal rights related to your personal data, including how to exercise those rights and how to contact the Company.
5. An explanation of our use of modern technologies, such as Artificial Intelligence (AI), to enhance service quality, complete with protective measures to ensure fairness, transparency, and the protection of your data and privacy rights.

This Notice applies to individuals who have a relationship with the Company, including, but not limited to: customers, telecom service subscribers, business partners, employees of our business partners, users of our websites and applications, or any individual in another capacity whose personal data we need to collect, use, or disclose. We encourage you to read this Notice carefully to understand how your personal data will be handled, and to learn about your rights and how to exercise them.

1. Who We Are

   “We” are:
   1. True Corporation Public Company Limited
   2. True Move H Universal Communication Co., Ltd.
   3. True Internet Corporation Co., Ltd.
   4. True Visions Group Co., Ltd.
   5. Bright Now Co., Ltd.

   In this Notice, these companies are referred to as the “Company” or “True”.
   When you use a product or service or conduct a transaction with any of the companies listed above, you are considered the “Data Subject” under the law. The specific company you are interacting with is legally the “Data Controller.” The Data Controller holds the legal responsibility for collecting, using, or disclosing your personal data in relation to that specific product, service, or transaction.
   For example, if you use mobile services under the Truemove H or dtac brand, True Move H Universal Communication Co., Ltd. is the Data Controller for your personal data associated with this service.

2. How We Collect Your Personal Data

   • Data Collected Directly From You
     The Company may collect your personal data directly from you through various interactions, such as:
     • When you subscribe to or use our services, including our telecommunication services (e.g., using the internet, making calls, or sending mobile messages), Company applications, and other service offerings.
     • When you enter into a contract with us, purchase products, register for an account, participate in activities, redeem rewards, or complete surveys.
     • When you contact the Company through our various communication channels, such as our Call Center, telephone, email, applications, or service centers.
     • When you access and use our websites.
   • Data Received From Third Parties
     As a general rule, we collect personal data directly from you. However, in some cases, we may receive your personal data from third parties who are legally entitled to disclose your information to us. Such instances include:
     • When you have authorized or instructed another company or individual to disclose your personal data to us.
     • When government agencies provide your personal data to us to implement public sector projects, for matters of public interest, or for other state functions, such as crime prevention and suppression or locating missing persons.

3. Types of Personal Data We Collect

   The Company may collect the following types of personal data:
   • Contact and Identity Verification Data: Such as your first and last name, national ID or passport number, telephone number, email address, postal address, photographs, and other information required by law for entering into contracts and registering for services.
   • Financial Data: Such as credit or debit card details, bank account numbers, or other payment information, including the amount, date, and time of your payments to the Company. This data is collected solely for payment convenience and only with your explicit consent. The collection of financial data does not include security codes (like CVV) used to authorize payments.
   • Service and Account Information: Such as the type of contract you have with us, your service subscriptions, the specific services you use, and your service payment history.
   • Network and Usage Data: Data from your use of our mobile and internet networks, your usage of Company applications, your service settings, and device information, including the location of your device when it connects to our network or services.
   • Communications Data: Such as recordings of your conversations with our staff, emails or letters you send to us, as well as data about your use of our websites and information that may be stored in cookies. (For more details, please see our Cookie Policy in Section 14).
   • Other Information You Provide: Such as information you provide when you agree to participate in competitions, prize draws, research surveys, promotions, or subscribe to newsletters and other special offers.

4. How and Why We Use Your Personal Data

   The Company will collect, use, or disclose your personal data only as necessary and for the following purposes:
   • To Fulfill Our Contract with You
     We process your data to provide services under the contracts you have with us (e.g., a telecommunications service agreement) or to take steps at your request before entering into such a contract. This primary purpose includes activities such as: registering and activating services, analyzing data to improve and develop our products, services, and network, offering products and services related to your contract, providing you with service-related information, managing billing and payments, and handling any other transactions related to our contractual agreement. For example, when you use our mobile services to make and receive calls or use the internet, we process and store related data, such as the numbers you call, your data consumption, and the date, time, and duration of your usage. This is necessary to provide the service and to calculate your bill. We also use your name and contact information to prepare and send you invoices.
     We need to collect and use your personal data for this purpose throughout the duration of your contract and for any additional period required by law. This may include retaining data to exercise our legal rights even after your contract has terminated. If you refuse to provide the personal data required for these contractual purposes, we will be unable to provide you with our services.
     For some specific services, we may need to collect and use sensitive personal data for these contractual purposes, such as information about visual or hearing impairments. In these instances, we will always request your explicit consent before collecting or using such data.
   • For Other Purposes Based on Your Consent
     We may request your consent to collect, use, or disclose your personal data for purposes beyond those required to fulfill our contract. Providing consent for these additional purposes is optional and will not affect the primary services we provide to you. You have the right to withdraw your consent at any time. To contact us, please see Section 9 regarding the Rights of the Data Subject.
     Use of Your Personal Data for Marketing Purposes
     To enhance your customer experience and provide you with relevant information about products and services from both the Company and our partners—activities that go beyond our primary contract—we may wish to use your personal data for marketing communications, promotions, advertising, statistical analysis, and other commercial campaigns. We will always ask for your consent before using your data for these marketing purposes. Granting this consent is entirely optional, and you can withdraw it at any time.
   • For Our Legitimate Interests
     We may process your data when it is necessary for the legitimate interests of the Company or another person or legal entity. Examples include preventing internal and external fraud, combating other illegal acts, and maintaining the stability and security of our systems, network, and services. We will only rely on this legal basis when our interests are not overridden by your fundamental rights and freedoms.
   • To Comply with Legal Obligations and Public Interest
     We may process your data to comply with our legal obligations, to perform a task carried out in the public interest, or to prevent or suppress a danger to a person’s life, body, or health. For example:
     • When law enforcement officials order the Company to disclose personal data for the prevention and suppression of technology-related crime or for a criminal investigation.
     • When a government agency orders the Company to use personal data to support a state mission or for the public interest, such as issuing disaster warnings or locating missing persons. Before disclosing personal data to any government agency, the Company will verify the validity of the order, the legal authority behind it, and the appropriateness and necessity of the disclosure.
       
       Regardless of the source, the Company will collect, use, or disclose your personal data only as necessary, for the purposes we have informed you of, or as permitted by law in each specific case.

5. How and to Whom We Disclose Your Personal Data

   To carry out the purposes specified in this Notice, such as fulfilling contracts and providing services, we may need to disclose your personal data to other individuals and legal entities as follows:
   • Our Affiliates, Partners, and Service Providers This includes our affiliated companies, agents, business partners, suppliers, and financial institutions who are involved in delivering our products and services. It also includes any third party acting as a Data Processor on our behalf. In such cases, these parties act as Data Processors under the law. We will establish a Data Processing Agreement (DPA) with them to ensure they process your personal data only for the purposes we specify and do not use it for their own purposes. We will only disclose the personal data necessary for them to perform their designated tasks. Furthermore, we require these Data Processors to implement appropriate data protection standards and security measures in line with all legal requirements.
   • Parties to Whom You Have Given Consent Any individual or entity to whom you have given consent or instructed us to disclose your personal data.
   • Government or Regulatory Authorities that have the legal power to order the disclosure of your personal data.

6. International Data Transfers

   The Company may need to transfer your personal data to individuals, entities, or international organizations located in foreign countries. This can occur, for example, when we store data on cloud systems with servers located outside of Thailand or when providing services that operate internationally, such as mobile roaming. We will ensure that any such international transfer of personal data is conducted in compliance with the Personal Data Protection Act (PDPA) and the criteria established by the Personal Data Protection Committee. This includes assessing the impacts and risks, and implementing relevant safeguards and contractual agreements to ensure that the destination country or receiving organization has adequate data protection standards and sufficient security.

7. How Long We Keep Your Personal Data

   บริษัทฯ The Company will retain your personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with any conditions or retention periods stipulated by law.
   Once the contractual services have ended and the legal retention period has expired, we will proceed to delete, destroy, or anonymize your personal data within a reasonable timeframe, unless other legal grounds require us to retain it.
   However, certain types of personal data (such as telecommunications usage data) are automatically deleted when their specific legal retention period expires, even if your contract with us is still active.

8. How We Protect Your Personal Data

   • Data Protection Officer
     The Company has appointed a Data Protection Officer (DPO) who is responsible for overseeing, advising, and auditing the operations of both the Company and its Data Processors to ensure that the collection, use, and disclosure of personal data complies with relevant laws and company policies.
   • Security Measures
     We implement appropriate technical and organizational security measures, aligned with international standards, to protect your personal data against unauthorized access, collection, use, disclosure, copying, modification, or destruction. Our dedicated security department regularly reviews and updates these security measures to ensure their effectiveness.

9. Your Rights as a Data Subject

   You have legal and contractual rights regarding the personal data that we collect, use, or disclose. We have therefore established the following procedures to help you exercise these rights conveniently and in accordance with the law.
   • Your Rights Explained
     (1) The Right to Access Your Data
     You can request access to and receive a copy of your personal data that we hold. Examples include your user account details, active promotions, call records, internet usage volume, invoices, and receipts.
     (2) The Right to Rectify Your Data
     We have a duty to ensure that your personal data is accurate, complete, current, and not misleading. If your personal information changes, or if you believe any of the data we hold is inaccurate, incomplete, or out-of-date, you can request to have it corrected.
     (3) The Right to Data Portability
     For personal data that is in a commonly used, machine-readable format and is processed by automated means, you have the right to receive a copy of your data in that format. You may also request that we transmit this data directly to another Data Controller, where technically feasible and not subject to other legal restrictions.
     (4) The Right to Object to Processing
     If you believe that our collection, use, or disclosure of your personal data is not for the purposes we have stated, or is otherwise not compliant with the Personal Data Protection Act, you have the right to object to such processing. (5) The Right to Restrict Processing
     You may request that we temporarily suspend the processing of your personal data while we are reviewing a request related to one of the following: (a) an objection to processing; (b) a request for erasure; or (c) a request for rectification. (6) The Right to Erasure (or 'Right to be Forgotten')
     To provide our contractual services, we are required to retain certain types of your personal data throughout your contract period, for periods mandated by law, and as necessary to exercise our legal rights, even after your contract has ended. In these situations, you may not be able to exercise your right to erasure immediately.
     
     However, in cases where there is no overriding legal requirement for us to retain your data, you may request that we delete, destroy, or anonymize your personal data if: (a) the data is no longer necessary for the purpose it was collected; (b) you withdraw your consent for a specific purpose; or (c) you have successfully objected to the processing.
     
     Please note that in some cases, we may not be able to fulfill your request to exercise a right due to legal or contractual obligations or other legitimate grounds. If we are unable to fulfill your request, we will inform you of the specific reason.
   • How to Exercise Your Rights
     (1) Contact Channels If you wish to exercise any of your rights, please contact us through one of the following channels:
     - In Person: At any True Shop branch.
     - By Phone: Call our Call Center at 1242.
     - By Email: dataprivacy@truecorp.co.th
     Please note: For the Right to Access, some of your information can also be accessed directly through our website at www.true.th or via the True App. (2) Identity Verification We are required to verify your identity before we can process your request. This is a security measure to ensure you are the genuine data subject and to prevent the unauthorized disclosure of your personal data. Our staff may ask you for specific information to complete this verification.
     (3) Processing Your Request We will review your request, take the necessary action, and inform you of the outcome. We may contact you to ask for additional details or supporting documents. We will also inform you of any limitations or potential impacts that exercising your right might have, particularly if it affects the services we are able to provide to you.
   • Opting Out of Marketing Communications
     During your time as a customer, we may send you information about marketing activities, promotions, and various products and services—both those directly related to your contract and others for which you have given consent. You have the right to opt out of receiving all or some of these marketing communications at any time by contacting us through the channels specified in this section.

10. Minors

    Any consent given or service contract entered into by an individual who has not yet attained legal majority must be done in accordance with the principles set forth in applicable law. The Company will not collect or use the personal data of minors under the age of 10 for any purpose other than providing core telecommunication services, regardless of whether parental or guardian consent has been provided.

11. Changes to This Privacy Notice

    This Privacy Notice will be regularly reviewed and updated to ensure it remains current and compliant with applicable laws. In the event of any changes to this Notice, we will inform you of such amendments by posting the updated version on our company website.

12. Use of Artificial Intelligence and Our AI Ethics

    The Company recognizes the importance of using Artificial Intelligence (AI) to enhance the efficiency, quality, security, and user experience of our services. Our use of AI is governed by a framework of Ethical AI and a commitment to responsible implementation. We may use AI for purposes such as recommending personalized services, supporting customer service functions, and preventing fraud.
    Our use of AI is subject to the following ethical principles:
    • Transparency: We will inform you when AI is used in a way that may have a significant impact on you.
    • Fairness and Non-Discrimination: Our AI systems are designed to be free from bias and to ensure that all individuals are treated equitably.
    • Human Oversight: Critical decisions will always be reviewed by a human to ensure they are fair and appropriate.
    • Privacy and Data Protection: Our use of AI will comply with the Personal Data Protection Act and respect your privacy.
    • Safety and Accountability: Our AI systems are regularly tested and monitored for safety, accuracy, and reliability.
    AI will not be used to make any final decisions without appropriate human involvement.

13. Questions About This Privacy Notice

    If you have any questions about your personal data, this Notice, or wish to exercise your rights under the Personal Data Protection Act, you can contact us through the following channels:
    
    Data Protection Office
    - Contact Address: Head Office, No. 18, True Tower, Ratchadaphisek Road, Huai Khwang Sub-District, Huai Khwang District, Bangkok 10310, or at any True - Shop branch.
    - Telephone: Call Center at 1242
    - Email : dataprivacy@truecorp.co.th

14. Use of Cookies

    We use cookies to enhance your experience and satisfaction when using our website, making it more accessible, user-friendly, and efficient. Our website may store or retrieve information from your browser in the form of cookies. This information might be about you, your preferences, or your device, and is primarily used to make the site work as you expect it to. While this information does not usually directly identify you, it can give you a more personalized web experience.
    For detailed information on our use of cookies, please refer to our
    Cookie Settings

Last updated : June 2025 (Version 2.1)