Operator’s Policy on Personal Data Processing

This Privacy Policy (hereinafter referred to as the Privacy Policy) is an integral part of the Public Offer of Montmari H Co., Ltd., posted on the Internet at: m2panama.com/ (hereinafter referred to as the Website).

Using the services of the Website signifies the unconditional consent of the User to this Privacy Policy and the conditions for processing their personal information specified herein; if the User disagrees with these conditions, they should refrain from using the services.

1.1. The Operator’s Policy on Personal Data Processing (hereinafter referred to as the Policy) is developed to ensure the protection of the rights and freedoms of the personal data subject during the processing of their personal data, including the protection of privacy rights, personal and family secrets.

1.2 The main concepts used in the Policy:

1.2.1. Personal data — any information related to a directly or indirectly identified or identifiable individual (personal data subject);
1.2.2. Personal data processing — any action (operation) or set of actions (operations) with personal data, performed with or without the use of automation tools. Personal data processing includes, among other things:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating, modification);
• extraction;
• use;
• transfer (distribution, provision, access);
• anonymization;
• blocking;
• deletion;
• destruction.

1.2.3. Automated processing of personal data — processing of personal data using computer technology;
1.2.4. Distribution of personal data — actions aimed at disclosing personal data to an undefined number of persons;
1.2.5. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons;
1.2.6. Blocking of personal data — temporary cessation of personal data processing (except in cases where processing is necessary to clarify personal data);
1.2.7. Destruction of personal data — actions resulting in the impossibility to restore the content of personal data in the personal data information system and (or) resulting in the destruction of tangible personal data carriers;
1.2.8. Anonymization of personal data — actions resulting in the impossibility to determine the belonging of personal data to a specific personal data subject without the use of additional information;
1.2.9. Personal data operator (operator) — a state body, municipal body, legal or natural person, independently or jointly with others organizing and (or) carrying out the processing of personal data, as well as determining the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data.

1.3. The operator who has access to personal data is obliged to maintain the confidentiality of personal data — not to disclose personal data to third parties and not to distribute personal data without the consent of the personal data subject, unless otherwise provided by law.
1.4. The personal data subject has the right to receive information related to the processing of their personal data, including:

1. confirmation of the fact of personal data processing by the operator;
2. legal grounds and purposes for personal data processing;
3. purposes and methods used by the operator for personal data processing;
4. the name and location of the operator, information about persons (except for employees of the operator) who have access to personal data or to whom personal data may be disclosed under a contract with the operator or by law;
5. processed personal data related to the respective personal data subject, the source of their receipt, unless another procedure for providing such data is provided by law;
6. the processing period of personal data, including the storage period;
7. the procedure for exercising the rights of the personal data subject provided by law;
8. information about the performed or intended cross-border data transfer;
9. the name or surname, first name, and address of the person processing personal data on behalf of the operator, if the processing is assigned or will be assigned to such a person;
10. other information provided by the law "On Personal Data" or other laws.

1.5. The personal data subject has the right to demand the operator to clarify their personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, illegally obtained, or not necessary for the declared purpose of processing, and to take measures provided by law to protect their rights.

1.6. The personal data subject has the right to protect their rights and legitimate interests, including compensation for damages and (or) moral harm in court.

1.7. The personal data operator has the right to:
— defend their interests in court;
— provide personal data of subjects to third parties if provided by applicable law (tax authorities, law enforcement agencies, etc.);
— refuse to provide personal data in cases provided by law;
— use the personal data of the subject without their consent in cases provided by law.

2.1. The processing of personal data is limited to achieving specific, predetermined, and legitimate purposes. It is not allowed to process personal data incompatible with the purposes of collecting personal data.

2.2. The purposes of personal data processing arise, among other things, from the analysis of legal acts regulating the operator’s activities, the purposes of the operator’s actual activities, as well as activities provided for by the operator’s constituent documents, and specific business processes of the operator in specific personal data information systems (by structural units of the operator and their procedures concerning specific categories of personal data subjects).

2.3. The purposes of the operator’s personal data processing include:

• conclusion, execution, and termination of civil law contracts;
• organization of personnel records of the organization, ensuring compliance with laws, conclusion and execution of obligations under labor and civil law contracts;
• maintaining personnel records, assisting employees in employment, training, and career advancement, using benefits;
• fulfilling tax legislation requirements for calculating and paying personal income tax, contributions to extrabudgetary funds, and insurance premiums to extrabudgetary funds, pension legislation when forming and transmitting personalized data on each income recipient, which is taken into account when calculating contributions for mandatory pension insurance;
• filling out primary statistical documentation in accordance with labor, tax legislation, and other laws.

3.1. The legal grounds for personal data processing are:

• a set of legal acts of Thailand, in pursuance of which and in accordance with which the operator processes personal data;
• the operator's constituent documents;
• contracts concluded between the operator and the personal data subject;
• consent to personal data processing.
• Scope and Categories of Processed Personal Data, Categories of Personal Data Subjects

4.1. The content and scope of processed personal data correspond to the declared purposes of processing. The processed personal data must not be excessive in relation to the declared purposes of their processing.

4.2. The processing of personal data is allowed in the following cases:

• personal data processing is carried out with the consent of the personal data subject to the processing of their personal data;
• personal data processing is necessary for the execution of a contract to which the personal data subject is a party, beneficiary, or guarantor, as well as for concluding a contract on the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;
• personal data processing is necessary to protect the life, health, or other vital interests of the personal data subject if obtaining the consent of the personal data subject is impossible;
• personal data processing is necessary to exercise the rights and legitimate interests of the operator or third parties, provided that this does not violate the rights and freedoms of the personal data subject;
• personal data processing is necessary for the professional activities of a journalist and (or) the legitimate activities of the media, or for scientific, literary, or other creative activities, provided that this does not violate the rights and legitimate interests of the personal data subject;
• personal data processing is carried out, access to which is granted to an unlimited number of persons by the personal data subject or at their request (hereinafter — personal data made publicly available by the personal data subject);
• personal data processing is carried out, which is subject to publication or mandatory disclosure in accordance with the law;

4.3. Categories of personal data subjects include:

4.3.1. Operator’s employees, former employees, candidates for vacant positions:

• surname, first name;
• gender;
• citizenship;
• nationality;
• date (day, month, year) and place of birth (country, republic, territory, region, district, city, town, village, other locality);
• address of residence (postal code, country, republic, territory, region, district, city, town, village, other locality, street, house, building, apartment);
• information about registration at the place of residence or stay (postal code, country, republic, territory, region, district, city, town, village, other locality, street, house, building, apartment);
• phone numbers (home, mobile, work), email address;
• position held;
• information about work activity (names of organizations (bodies) and positions held, duration of work (service) in these organizations (bodies));
• taxpayer identification number (date (day, month, year) and place of registration, date (day, month, year) of certificate issuance);
• data of the document confirming registration in the individual (personalized) accounting system, including in the form of an electronic document;
• data of the mandatory health insurance policy;
• data of the passport or other identity document;
• information on obtaining additional professional education (date (day, month, year), place, program, details of documents issued based on results); 
• information on proficiency in foreign languages (foreign languages, proficiency level);
• information on criminal record (presence (absence) of a criminal record, date (day, month, year) of prosecution (expungement or removal of the criminal record), article);
• information on legal capacity (details of the document establishing guardianship (custodianship), reasons for limitation of legal capacity, court decision details);
• information on participation in the management of a business entity (excluding housing, housing construction, garage cooperatives, gardening, vegetable gardening, dacha consumer cooperatives, homeowners' associations, and trade unions registered in the prescribed manner), engagement in entrepreneurial activities;
• information on disciplinary actions;
• information contained in internal investigations;
• information on marital status (married (unmarried), married (remarried), divorced, widowed, duration of marriage, duration of divorce, number of marriages, family composition, marriage certificate details);
• information on close relatives, relatives by marriage (degree of kinship, surname, first name, patronymic, date (day, month, year) and place of birth, place and address of work (service), address of residence, information on registration at the place of residence or stay);
• information contained in income, expense, property, and property obligations declarations;
• bank account number;
• information on state secret clearance;
• photographs.

4.3.2. Clients and contractors of the operator (individuals):

• surname, first name;
• gender;
• phone numbers (home, mobile, work), email address.

4.3.3. Representatives/employees of the operator’s contractors (legal entities):

• surname, first name;
• gender;
• phone numbers (home, mobile, work), email address;
• position held;
• data of the passport or other identity document;
• information on participation in the management of a business entity, engagement in entrepreneurial activities.

5.1. The operator processes personal data — actions performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion, destruction of personal data.

5.2. The processing of personal data is carried out in compliance with the principles and rules provided by the law "On Personal Data".

5.3. The processing of personal data by the operator is limited to achieving specific, predetermined, and legitimate purposes. Only personal data that meet the purposes of their processing are subject to processing. The content and scope of the processed personal data must correspond to the declared purposes of processing.

5.4. The storage of personal data must be in a form that allows determining the subject of personal data, no longer than required by the purposes of personal data processing, unless the period of personal data storage is established by federal law, a contract to which the personal data subject is a party, beneficiary, or guarantor. The processed personal data are subject to destruction or anonymization upon achieving the purposes of processing or in case of loss of the need to achieve these purposes, unless otherwise provided by federal law.

5.5. The condition for the termination of personal data processing may be the achievement of the purposes of personal data processing, the expiration of the consent period, or the withdrawal of the consent of the personal data subject to the processing of their personal data, as well as the detection of unlawful processing of personal data.

5.6. The operator has the right to entrust the processing of personal data to another person based on a contract concluded with this person.

5.7. The operator and other persons who have access to personal data are obliged not to disclose personal data to third parties and not to distribute personal data without the consent of the personal data subject unless otherwise provided by federal law.

Consent to the processing of personal data authorized by the personal data subject for distribution is issued separately from other consents of the personal data subject to the processing of their personal data. The operator is obliged to ensure that the personal data subject can determine the list of personal data for each category of personal data specified in the consent to the processing of personal data authorized by the personal data subject for distribution.

The transfer (distribution, provision, access) of personal data authorized by the personal data subject for distribution must be terminated at any time at the request of the personal data subject. This request must include the surname, first name, patronymic (if available), contact information (phone number, email address, or postal address) of the personal data subject, and the list of personal data whose processing must be terminated. The personal data specified in this request can be processed only by the operator to whom it is sent.


5.8. The operator, when processing personal data, takes necessary legal, organizational, and technical measures or ensures their adoption to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions regarding personal data.

6.1. Montmari H Co., Ltd. has the right to carry out the cross-border transfer of your personal data to foreign developer companies (Thailand).

6.2. Montmari H Co., Ltd. ensures that adequate protection of the personal data subjects' rights is provided in the foreign country where the personal data is supposed to be transferred before such transfer begins.

6.3. The country where your personal information may be used for cross-border transfer is Thailand.

6.4. This transfer is carried out exclusively when necessary to provide this information to developer companies and with the User's consent.

7.1. The User is obliged to:

7.1.1. Provide information about personal data necessary for using the Website.
7.1.2. Update, supplement the provided information about personal data in case of changes to this information.

7.2. The Website Administration is obliged to:

7.2.1. Use the obtained information exclusively for the purposes specified in this Privacy Policy.
7.2.2. Ensure the confidentiality of the information, not disclose it without the User's prior written permission, and not sell, exchange, publish, or disclose the User's personal data by other possible means, except for cases provided for by this Privacy Policy.
7.2.3. Take all necessary legal, organizational, and technical measures to protect the User's personal data from unauthorized, unlawful, or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions regarding personal data.
7.2.4. Block personal data related to the relevant User from the moment of the User's or their legal representative's or authorized body's request to protect the personal data subjects' rights for the period of verification in case of inaccurate personal data or unlawful actions.

8.1. The Website Administration, which has not fulfilled its obligations, is liable for losses incurred by the User due to the unlawful use of personal data in accordance with the law.

8.2. In case of loss or disclosure of confidential information, the Website Administration is not responsible if this confidential information:

8.2.1. Became public domain before its loss or disclosure.
8.2.2. Was received from a third party before it was received by the Website Administration.
8.2.3. Was disclosed with the User’s consent.

9.1. Before applying to court with a claim for disputes arising from the relationship between the User and the Website Administration, it is mandatory to submit a claim (a written proposal for a voluntary settlement of the dispute).

9.2. The recipient of the claim within 45 calendar days from the date of receipt of the claim notifies the claimant in writing about the results of the consideration of the claim.

9.3. If an agreement is not reached, the dispute will be referred to the court in accordance with the current legislation of Thailand.

9.4. This Privacy Policy and the relationship between the User and the Website Administration are subject to the current legislation of Thailand.

10.1. The Website Administration has the right to make changes to this Privacy Policy without the User's consent.

10.2. The new Privacy Policy comes into force from the moment it is posted on the Website unless otherwise provided by the new edition of the Privacy Policy.

10.3. All suggestions or questions regarding this Privacy Policy should be reported to oceansidepanama@gmail.com