Privacy Policy

This is an English translation of our Thai privacy policy, provided for your convenience. If the two differ, the Thai version prevails.

Unigin Ventures Company Limited ("the Company" or "we"), a venture capital firm in ThaiAce Group that invests in and supports startups and SMEs, as data controller, publishes this policy to tell you how we collect, use, disclose and look after your personal data under the Personal Data Protection Act B.E. 2562 (2019) and related laws ("the data protection law"). By using the website, sending a form or contacting the Company, you acknowledge this policy.

The conditions for using the website, including the list of cookies and the buttons for the statistics cookie, are in the website terms of use.

1. Scope

• This policy covers personal data the Company receives through www.uniginventures.com ("the website"), namely the contact form, applications for training courses, seminars or events, and course fee payments, as well as the telephone number and email address shown on the website.
• It does not cover websites, apps or services of third parties, even when the website links to or shows them, such as Facebook, X (Twitter), LINE, YouTube, Google Maps, Stripe and the websites of our group companies or of the companies we have invested in, which have their own policies. The Company has no control over, and is not responsible for, how those third parties collect, use or disclose data.
• If you enter into a contract with the Company, such as an investment agreement, a confidentiality agreement or a service contract, the data terms of that contract apply together with this policy. Where they conflict, the contract prevails.

2. The personal data we collect

2.1 Data you give us

• The contact form (on the Contact Us page): your full name, email, phone number, subject and the message you write. The Company keeps the message in the website's system, emails it to the team at contact@uniginventures.com, and staff record its status and their follow-up notes in the back office.
• Applications for training courses, seminars or events (courses and seminars): your full name, phone number, email and the other details each programme's form asks for, such as LINE ID, company or organisation, province, district, answers to the programme's own questions and your message to the team, together with the status of your application (for example confirmed, attended, or cancelled with the reason) and staff notes made while handling it.
• Course fee payments (paid programmes only): the amount due, the payment method, the payment status and the date and time of payment, and
  • if you scan the Company's PromptPay QR code or transfer money to the Company's account: the payment slip you upload, which may show the payer's name, the bank, part of an account number, the amount and the transaction number, together with the result of the staff check and the reason if the slip is not accepted;
  • if you pay online through Stripe: the transaction reference and the result that Stripe reports back. You enter your card details on Stripe's own payment page, so the Company never receives or stores your card number, expiry date or security code (CVC);
  • if you pay another way agreed with our staff, such as cash: the staff record of the payment and their notes.
• Attending a training course, seminar or event: your registration and attendance, and photos or videos of the event, in which participants may appear. The Company may show these on the programme's page on the website (for example in a photo album) or in its other media. If you do not want a picture in which you can clearly be seen to be used, please tell our staff at the event or contact us as in section 13; we will stop using it and remove it from the website.
• Contact by telephone or email: the messages, pictures and documents you send, such as information about a business you propose for investment or cooperation (business plan, details of the founders and team, financial information), or your details as an investor interested in co-investing.

2.2 Data collected automatically

• Technical data when an application is sent: IP address, browser and device details (User-Agent), date and time, and the channel or web page that brought you to the application (such as a QR code or a post), for security, to prevent duplicate applications, applications in someone else's name or other misuse, and as a record of the application.
• Spam screening of the contact form: each message is scored automatically from technical signals, such as a hidden field that people cannot see, the time between opening the page and sending, the number of links in the message, and the same text sent from another email address within 180 days; the score and the reasons are kept with the message. A message marked as spam is still kept for staff to review, but the team is not emailed about it. This screening only sorts out spam and is not used to decide anything else about you.
• Form records: every time a form is sent, the system records the technical result: date and time, the form's name, the outcome (for example saved, incomplete or a system error), the names of fields that need correcting, the number of the record that was saved, the page language, the type of device and browser (User-Agent), the size of the data and the time taken, and errors on the page, so that the people who look after the website learn about, and fix, any problem that stops your data from reaching the Company. These records never contain what you typed or the names of files you attached, and keep the IP address only as a one-way code (hash) that cannot be turned back into the IP address.
• Website statistics and cookies: see section 8.
• Server access logs: containing IP addresses and the pages requested, kept for a short time for system security.

2.3 Data received from others

The Company may receive your data from someone who applies or makes contact on your behalf, such as an organisation's coordinator who sends a list of participants, or from someone who refers you or your business to us, such as a group company, a co-investor or a business partner. That person has the duties in section 9.

2.4 Sensitive personal data

The Company does not intend to collect sensitive data, such as race, political opinions, religious beliefs, health data, criminal records or biometric data. Please do not send such data unless it is needed. If a programme needs it, for example food allergies for catering at an event, the form will say so. Giving it is voluntary, and filling it in and sending the form is explicit consent to its use for that purpose only.

2.5 What we do not collect

• What you type in a form before you send it (the statistics only record that you started or sent a form, and the names of fields that need correcting).
• Your card number, expiry date and security code when you pay through Stripe.
• Data from advertising pixels, marketing cookies or third-party analytics tools: the website does not use them.

3. Purposes and lawful bases

If you do not provide the data that is needed, the Company may be unable to consider your application or proposal, call you back or serve you. If the Company wishes to use data for a new purpose unrelated to the above, it will tell you and ask for consent where the law requires.

4. Disclosure of personal data

The Company does not sell personal data. It may disclose data, as far as necessary for the purposes in section 3, to:

• service providers working for or supporting the Company, such as the developer that builds and maintains the website, and providers of website hosting, servers, email and payment systems, advisers and auditors, under a duty of confidentiality;
• Stripe, when you choose to pay through Stripe: the Company sends Stripe the amount, the application reference, the programme's name and your email address (if you gave one) to open the payment page; what you enter on Stripe's page is governed by Stripe's own privacy policy;
• co-organisers, speakers, venues and partners of the programme you apply for, limited to the data needed to run that programme;
• companies in ThaiAce Group, for the purposes in this policy;
• co-investors, investors or business partners, when you ask the Company to introduce you or match your business, or with your consent, limited to the data needed for that matter;
• a buyer, transferee or merger party in a restructuring, merger or transfer of the business;
• government authorities, courts or other persons with legal authority, or where needed to protect the rights, property or safety of the Company, its customers or others.

If a programme you apply for has a LINE group for participants, joining it is voluntary. Other members of the group will see your display name, profile picture and the messages you post, as LINE works and is set up, which is outside the Company's control.

5. Transfers outside Thailand

Some data may be sent to or stored on the systems of service providers located outside Thailand, such as the online payment provider (Stripe) and the providers of the fonts, map and videos on our pages (Google). The Company will act in line with sections 28 and 29 of the data protection law, for example where the destination has adequate protection, appropriate safeguards are in place, or an exemption under the law applies.

6. How long we keep data

• Applications, contact-form messages (including those marked as spam), records of contacts and of people who propose a business for investment, and correspondence: for as long as needed for the purposes, and for up to 10 years after the last contact or relationship, in line with the general prescription period of the Civil and Commercial Code, or longer if the law requires or there is a dispute.
• Payment records, payment slips, and accounting and tax records: for the periods the law requires.
• Records of consent given or withdrawn: for as long as needed to show compliance with the law.
• Website statistics: kept to follow long-term trends and not deleted on a schedule. Statistics counted anonymously cannot be traced back to you. The link between your visits and a form you sent (where your browser was remembered) is removed when you ask.
• Form records: kept as a history of how the system works; they contain nothing you typed, and the IP address only as a one-way code.
• Server access logs: for a short time, as the system rotates them.

Applications are not deleted automatically, because they are the record of the courses held and of the places confirmed. When you ask for your data to be deleted, the Company masks your name, contact details, answers, messages, IP address and the link to the visit statistics so that you can no longer be identified, keeping only the reference code, the status and the handling history of the application, to count participants. For payments, the Company deletes the slip file and keeps only the amount, the method, the status and the time as accounting records. After the periods above, the Company deletes or destroys the data, or makes it impossible to identify you.

7. Your rights

Subject to the conditions of the data protection law, you have the right to:

• withdraw consent you have given;
• access your data and obtain a copy, and ask how we obtained data you did not consent to;
• receive your data, or have it sent or transferred, in a machine-readable format;
• object to the collection, use or disclosure of your data;
• have your data deleted, destroyed or made impossible to identify you;
• have the use of your data restricted;
• have your data corrected so that it is accurate, up to date, complete and not misleading;
• complain to the Office of the Personal Data Protection Committee (www.pdpc.or.th).

You can exercise these rights by contacting us as in section 13, in particular by email to contact@uniginventures.com. The Company may ask for proof of identity before acting, and will consider your request and reply within 30 days of receiving a complete request, or within the period the law sets.

The Company may refuse a request, or carry it out only in part, where the law allows, for example where the data must be kept by law, is needed to establish, exercise or defend legal claims, or where acting on the request would affect the rights of others; it will tell you why. Withdrawing consent does not affect what was done before the withdrawal, and may mean the Company can no longer provide some services to you. For requests that are unfounded, repetitive or excessive, the Company may refuse or charge a reasonable fee, as far as the law allows.

8. Cookies and website statistics

The full list of cookies the website uses, how long they last, and the buttons to accept or decline statistics cookies are in the cookies section of the website terms of use.

• The Company uses its own statistics system, and the data stays in the Company's own system. We use no Google Analytics or other third-party analytics tools, no advertising pixels and no marketing cookies.
• The statistics system records the pages you open and their language, the time spent on each page, how far you scroll, the website or app that brought you here, including campaign tags in the link (such as utm_source), your type of device, browser, operating system and the language set on it, clicks on links and buttons (only the text on the button and the page the link leads to), starting or sending a form, your screen size, your device's time zone (which tells us the country roughly, instead of your IP address) and errors that occur on the page in your browser. If a form cannot be sent, only the names of the fields that need correcting are recorded, never what you typed. Visits by automated programs (bots) are kept apart and are not counted in the statistics, and staff are not counted while they are signed in to the back office.
• Using the website means accepting cookies under the website terms of use: the website shows no cookie consent bar. From the first page you open, the Company sets the cx_vid cookie, which holds a random code for 13 months from your latest visit, to recognise that this browser has visited before; when you send the contact form or an application, the Company links this browser's visits to this website with what you sent, to improve its communication and services.
• You can decline at any time with the "Decline statistics cookies" button in the cookies section of the terms of use (the "Terms of Use" link at the bottom of every page leads there). If you decline, the Company deletes the cx_vid cookie and counts your visits anonymously only, using a daily code calculated from your IP address and browser details together with a random value that is deleted within 2 days. The Company does not record your IP address in the statistics, and does not link the statistics to any form you send. Your choice is kept in the cx_consent cookie for 13 months.
• If your browser signals that it does not want to be tracked (Do Not Track or Global Privacy Control), the Company does not remember your browser and counts your visits anonymously only, unless you press accept yourself.
• Ordinary pages set no other cookie. The cookies the website needs to work, the session cookie and the cookie that protects against forged requests (XSRF-TOKEN), are used only on the pages that need them, such as the course sign-up and payment pages, and while staff are signed in to the back office; they cannot be switched off.
• Pages load fonts from Google Fonts; the Contact Us page shows a Google Maps map, which loads from Google when you open that page; and some course pages show a YouTube video, which loads from youtube-nocookie.com only when you press play. These providers may receive your IP address and browser details as a normal part of delivering the files, and Google may store or read data on your device when the map is shown or when you play the video, under Google's own policy. The share buttons on article pages are plain links: nothing loads from Facebook, LINE or X until you press one.
• You can delete or block cookies in your browser settings, but parts of the website may not work fully, and if you delete all of this website's cookies, your decision to decline is deleted too.

9. Your duties when you give us data

• You must give accurate, complete and up-to-date data, and tell the Company when it changes.
• If you give us data about other people, such as staff of your organisation, the founders or team of a business, contacts or fellow participants, you confirm that you have told them about this policy and have their consent or another lawful basis to give that data to the Company.
• You are responsible, as the law provides, for damage caused by giving false data or giving other people's data without the right to do so.

10. Minors

The website and services are intended for persons who have reached the age of majority and for legal entities. A minor who wishes to apply or send data must have the consent of the person exercising parental power, as the law requires. If the Company learns that it has received a minor's data without such consent, it may refuse the application or request and deal with the data as the law requires.

11. Security

• The Company uses appropriate organisational and technical measures, such as encrypted connections (HTTPS), a separate account for each member of staff, access to the back office limited by role, a record of which member of staff handled which record, and hashed passwords. Payment slip files are kept in storage that is not open to the public and can be viewed only by staff with the right to do so.
• Employees and service providers have access only to the data their work needs, under a duty of confidentiality.
• If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee and you as the law requires.
• No method of sending or storing data electronically is completely secure. To the extent the law allows, the Company is not liable for damage caused by events beyond its reasonable control, such as unauthorised access by third parties despite appropriate measures, or faults in your own devices, accounts or networks.

12. Changes to this policy

The Company may update this policy from time to time. The latest version is shown on this page with the date it takes effect, and takes effect when published. For significant changes, the Company will announce them on the website and ask for consent again where the law requires. Continuing to use the website after a change means you acknowledge the new version.

13. Contact

Unigin Ventures Company Limited
555 Nawamin Road, Khlong Kum, Bueng Kum, Bangkok 10240
Tel. (+66) 2744-2399 · Email contact@uniginventures.com
Monday to Saturday 08:30–17:30 (please mark your message "Personal data")

14. Governing law

This policy is governed by and interpreted under Thai law, and disputes about it fall under the jurisdiction of the Thai courts. The Thai version is the original; if this English translation differs from it, the Thai version prevails.

See also: Website terms of use · นโยบายความเป็นส่วนตัว (ภาษาไทย)