Privacy notice and personal data protection

Personal data we may collect

When you register, create a TMTA Digital ID, or use the system, we may collect:

• Identity and profile: Thai/English name, gender if provided, date of birth, province
• Membership administration: application dates, type and status, expiry or lifetime label
• Contact: mobile phone and other channels you choose to provide, including an email left on the Connect welcome page so staff can remind you to return and update business information
• Business information you choose to submit
• Technical and account-security data such as login times

QR codes and member verification

The Digital Member Card QR carries only a short-lived signed token, or a URL that carries one. We do not put name, phone, email, address, national ID, or a bare Digital Member ID in the QR. Verification is decided by the backend and returns display-safe fields only.

Purposes

We may process personal data to:

• Administer membership, benefits, and status contact
• Provide TMTA Digital ID, the Digital Member ID, the card, and QR verification
• Run Association events: registration, eligibility, attendance, and improvement
• Send necessary service notices such as renewal, security, or material announcements
• Remind you, when you asked via the Connect welcome page, to return and complete identity verification or business updates (transactional; not marketing)
• Analyse usage in aggregate to improve benefits, events, and the platform

Legal bases

We rely on the basis that fits each purpose, including contract or steps at your request, legal obligation, legitimate interests, and consent only where the law requires it. We do not ask for consent when another lawful basis is sufficient.

Disclosure

We do not sell or rent member personal data. We may disclose data only as needed to system or technology providers, event or benefit partners, or public authorities when legally required. Recipients see only what that purpose needs.

Retention and security

We keep data only as long as the stated purposes, membership period, legal duties, or legal claims require. When no longer needed, we delete, destroy, or de-identify it as appropriate.

We use access control, authentication, encryption where appropriate, logging, and backups. OTP codes, session tokens, and QR tokens are never written to application logs.

Cross-border transfers

TMTA Digital ID may use cloud or technology providers with systems outside Thailand. Transfers follow PDPA requirements and appropriate safeguards.

Your rights

Subject to legal conditions, you may request access, rectification, erasure, restriction, objection, portability, withdrawal of consent where processing is based on consent, and lodging a complaint with the competent authority.

Withdrawing marketing consent does not undo processing already completed and does not remove access to TMTA Digital ID. Necessary service notices may continue.

Marketing

We may contact you about membership or necessary service matters without a marketing opt-in. An email left on the Connect welcome page for a later return reminder is a transactional service notice, not marketing. Promotional news, events, and campaigns that require consent are collected separately. You may decline and still use Digital ID.

Cookies and changes

The website may use cookies or similar technology to remember sign-in, protect the session, and improve use.

Material changes are communicated through an appropriate channel. A new version must be acknowledged again at the next login.