Privacy Notice for the TREEGAL Application
Notice : This English version is provided for translation purposes only. In the event of any inconsistency or discrepancy between the Thai and English versions, the Thai version shall prevail.
T.N. Digital Solutions Co., Ltd. (“Company” or “Service Provider”) places great importance on the protection of personal data of users of the TREEGAL application (including the name KODM.AI) (“Application”). This Privacy Notice explains how the Company collects, uses, discloses, and retains your personal data, as well as your rights as a data subject under the Personal Data Protection Act B.E. 2562 (2019) and other applicable laws.
By using the Application, you acknowledge that you have read and understood this Privacy Notice.
1. Definitions
For clarity of interpretation, the following terms used in this Privacy Notice shall have the meanings set forth below, unless the context otherwise requires :
1.1 “Personal Data” means any information relating to a natural person that enables the identification of such person, whether directly or indirectly, but does not include data of deceased persons in particular.
1.2 “Sensitive Personal Data” means personal data classified by law as requiring special protection, such as data relating to race, religion, political opinions, criminal records, health information, or biometric data. The Company does not intend to collect such data unless required by law or with explicit consent from the data subject.
1.3 “Data Subject” means a natural person who is the owner of the Personal Data collected, used, or disclosed by the Company through the Application.
1.4 “Processing” means any operation performed on Personal Data, including collection, use, disclosure, storage, recording, modification, deletion, destruction, or any other action, whether by automated means or otherwise.
1.5 “Company” or “Data Controller” means T.N. Digital Solutions Co., Ltd., which determines the purposes and means of processing Personal Data under this Privacy Notice.
1.6 “Data Processor” means a person or juristic entity that processes Personal Data on behalf of or under the instructions of the Company.
1.7 “Application” means the TREEGAL application (including the name KODM.AI) and all related services provided through electronic devices.
2. Types of Personal Data Collected
The Company may collect your Personal Data when you register, use the Application, communicate with the Company, or conduct transactions through the system. The categories of Personal Data collected may include, but are not limited to, the following :
2.1 Account Information
Includes full name, username, email address, telephone number, password (in encrypted form), and other information used for registration and identity verification.
2.2 Usage Data
Includes search history, queries submitted to the AI system, feature usage history, timestamps, and in-app behavioral interactions.
2.3 Device and Technical Information
Includes device type, device model, operating system, application version, IP address, network information, and log data.
2.4 Payment Information
Includes subscription type, subscription date, payment status, and transaction history. The Company does not directly store credit card numbers where payments are processed through third-party providers.
2.5 User Input Data
Includes text, queries, or other information submitted to the AI system for processing or analysis.
2.6 Communication Data
Includes information provided when contacting the Company for inquiries, support, or complaints.
2.7 Cookies and Similar Technologies
Includes data generated through technologies used for analytics, system performance monitoring, or service improvement.
2.8 Notification Data
Includes the history of notifications delivered to the User through the Application, as well as the receipt and read status of such notifications.
The Company collects only Personal Data that is necessary and relevant for the provision of Services and does not collect Sensitive Personal Data unless explicit consent is obtained or required by law.
3. Purposes of Processing
The Company processes your Personal Data as necessary and in compliance with applicable laws for the following purposes :
3.1 To provide the Services of the Application
Including creating and managing user accounts, providing legal search services, processing queries through the AI system, maintaining usage history, and delivering subscription services.
3.2 To process transactions and payments
Including billing, subscription management, renewals, cancellations, and verification of payment status.
3.3 To improve and develop the Services
Including analyzing usage behavior, evaluating system performance, enhancing AI system quality, and developing new features.
3.4 To ensure system security and prevent misuse
Including monitoring irregular activities, preventing unauthorized access, preventing fraud, and maintaining data security.
3.5 To communicate with Users
Including sending account notifications, security alerts, billing notifications, responding to inquiries, and delivering promotional communications where consent has been provided.
3.6 To comply with legal obligations or lawful orders
Including compliance with applicable laws, data retention requirements, and disclosures pursuant to court orders or governmental authorities.
The Company will not process Personal Data for purposes other than those stated in this Privacy Notice unless consent is obtained or permitted by applicable law.
4. Legal Basis for Processing
4.1 Contractual Basis
The Company processes Personal Data as necessary to enter into and perform the service agreement between you and the Company, including account creation, provision of legal search services, operation of the AI system, and subscription management.
4.2 Consent
Where required by law, the Company will obtain your consent prior to collecting, using, or disclosing Personal Data, such as for promotional communications or the processing of Sensitive Personal Data. You have the right to withdraw your consent at any time.
4.3 Legitimate Interest
The Company may process Personal Data for its legitimate interests or those of third parties, provided that such interests do not override your fundamental rights. This includes system security, fraud prevention, service improvement, and service development.
4.4 Legal Obligation
The Company may process Personal Data where necessary to comply with applicable laws, court orders, or lawful requests from governmental authorities.
The Company will rely on the appropriate legal basis depending on the nature and purpose of the processing activity and will not process Personal Data without a valid legal basis.
5. Disclosure of Personal Data
The Company may disclose your Personal Data as necessary and in compliance with applicable laws to the following persons or entities :
5.1 Service Providers
Including cloud infrastructure providers, analytics providers, payment processors, system security providers, or other service providers supporting the operation of the Application. Such providers will process Personal Data under the Company’s instructions and subject to appropriate data protection agreements.
5.2 Third-Party Platforms
Including platforms used for application distribution or payment processing, such as the Apple App Store or Google Play Store, which may process certain data in accordance with their own terms and privacy policies.
5.3 Governmental or Regulatory Authorities
Where the Company is required to disclose Personal Data pursuant to applicable laws, court orders, or lawful requests from competent authorities.
5.4 Other Persons or Entities with Your Consent
Where explicit consent has been obtained from you.
The Company does not sell, trade, or disclose your Personal Data for commercial purposes to third parties unless consent has been obtained or required by law.
6. Cross-Border Data Transfer
6.1 The Company may transfer your Personal Data to foreign countries where necessary for the provision of Services through technological infrastructure, cloud systems, analytics services, or other supporting services that may be located outside Thailand.
6.2 Where Personal Data is transferred internationally, the Company will ensure that the destination country or recipient implements adequate data protection standards or that appropriate safeguards are in place, such as Data Processing Agreements or other legally recognized data protection mechanisms.
6.3 In certain circumstances, the Company may rely on your consent to transfer Personal Data to countries that do not provide adequate data protection standards as prescribed by law.
6.4 The Company will take appropriate measures to ensure that such transfers are conducted securely and in compliance with the Personal Data Protection Act B.E. 2562 (2019) and other applicable laws.
7. Data Retention
7.1 The Company will retain your personal data only for as long as necessary to fulfill the purposes set out in this Privacy Notice or as required by applicable laws. The retention periods for each category of personal data are as follows :
(a) User account data and general usage data will be retained for the duration of the existence of the User’s account.
(b) Notification Data will be retained for a period of ninety (90) days from the date of each notification, after which the Company will automatically delete such data from its systems.
(c) All other categories of personal data shall be retained in accordance with the periods specified in Sections 7.2 and 7.3.
7.2 In the event that a User cancels their account, does not renew their Subscription, or is downgraded to a lower-tier plan, the Company will proceed as follows :
(a) User-generated content and stored data, such as documents, notes, files, and other content created or stored through the Application, will be retained for a period of thirty (30) days from the effective date of such change, during which the User may export (Export) their data from the system prior to deletion. Upon expiration of this period, the Company will permanently delete such data from its systems (Hard Delete).
(b) Data subject to legal retention obligations, such as account information, transaction records, and payment data, will be retained for the period required under applicable laws, notwithstanding any account cancellation or plan downgrade.
The Company will notify the User through appropriate channels prior to any permanent deletion, in order to provide the User with an opportunity to export (Export) or back up any necessary data.
7.3 Upon expiration of the applicable retention period, the Company will securely delete, destroy, or anonymize Personal Data using appropriate methods.
8. Data Subject Rights
8.1 Right of Access
You have the right to request access to and obtain a copy of your Personal Data, including information about how such data was obtained where consent was not given.
8.2 Right to Rectification
You have the right to request correction of inaccurate, incomplete, or misleading Personal Data to ensure that it is accurate, current, and complete.
8.3 Right to Erasure
You have the right to request deletion, destruction, or anonymization of your Personal Data where such data is no longer necessary or has been unlawfully processed.
8.4 Right to Restrict Processing
You have the right to request suspension of processing of your Personal Data while the accuracy of the data is being verified or where you object to the processing.
8.5 Right to Object
You have the right to object to the processing of your Personal Data where the Company relies on legitimate interests as the legal basis, unless the Company demonstrates compelling legitimate grounds overriding your rights.
8.6 Right to Withdraw Consent
Where processing is based on your consent, you have the right to withdraw such consent at any time. Withdrawal will not affect the lawfulness of processing carried out prior to the withdrawal.
8.7 Right to Lodge a Complaint
You have the right to lodge a complaint with the Personal Data Protection Committee or other competent authority if you believe that the Company has violated applicable data protection laws.
The Company will respond to your request in accordance with the timeframe prescribed by law and may require verification of identity prior to processing your request.
8.8 Right to Data Portability
You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to request that such data be transmitted to another data controller where technically feasible, subject to conditions prescribed by applicable law.
The Company may refuse such request where it is technically infeasible or where exemptions under applicable law apply.
9. Data Security Measures
9.1 The Company implements appropriate technical and organizational measures to safeguard Personal Data against loss, unauthorized access, use, alteration, modification, or disclosure.
9.2 Such measures may include:
(a) Restricting access to Personal Data on a need-to-know basis;
(b) Implementing authentication and access control mechanisms;
(c) Encrypting data in transit;
(d) Storing data in systems protected by industry-standard security measures;
(e) Logging and monitoring access to systems.
9.3 The Company requires third-party service providers processing Personal Data on its behalf to implement appropriate data security measures and comply with applicable data protection laws.
9.4 While the Company takes reasonable steps to protect Personal Data, no information technology system can be guaranteed to be completely secure. In the event of a personal data breach, the Company will take actions in accordance with applicable legal requirements.
10. Children’s Data
10.1 The TREEGAL Application is not intended for the collection of Personal Data from children under thirteen (13) years of age, and the Company does not knowingly collect Personal Data from such individuals.
10.2 If the Company becomes aware that Personal Data has been collected from a child under thirteen (13) years of age without parental consent as required by law, the Company will promptly delete or destroy such data.
10.3 If you are a parent or legal guardian and believe that a child under your care has provided Personal Data to the Company without your consent, you may contact the Company through the contact details specified in Section 12 to request verification and deletion of such data.
11. Changes to This Privacy Notice
11.1 The Company may update or amend this Privacy Notice from time to time to reflect changes in services, technology, applicable laws, or relevant practices.
11.2 Where material changes are made, the Company will notify you through appropriate channels, such as in-app notifications, email communications, or other designated means.
11.3 The effective date of the most recent version will be indicated at the top of this document. Your continued use of the Application after such changes take effect constitutes acknowledgment of the updated Privacy Notice.
12. Contact for Data Protection Matters
12.1 If you have any questions, suggestions, or wish to exercise your rights under applicable data protection laws, including submitting a complaint regarding the collection, use, or disclosure of your Personal Data, you may contact the Company through the following channels :
T.N. Digital Solutions Co., Ltd.
Address : 3 Rajanakarn Building, 24th Floor, South Sathorn Road, Yannawa, Sathorn, Bangkok 10120, Thailand
General Contact Email : contact@treegal.law
Data Protection Email : privacy@treegal.law
Telephone : (+66) 2343 9192
12.2 The Company will review and respond to your request within the timeframe prescribed by applicable law or within a reasonable period. The Company may request additional information to verify your identity before processing your request.
12.3 If you believe that the Company has not complied with applicable data protection laws, you have the right to lodge a complaint with the Personal Data Protection Committee or other competent authority.