Data Privacy Policy

---

WHAT DOES MULA-X HOLDING (THAILAND) CO., LTD. (“MULA-X”)DO WITH YOUR PERSONAL INFORMATION? 

In providing service, companies will need to share your personal information. Thailand Personal Data Privacy Act of 2019 gives consumers the right to limit some but not all sharing. The law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. 

BACKGROUND INFORMATION Why do we collect information? 
Any of the information we collect from you may be used in one of the following ways:

• To personalize your experience (your information helps us to better respond to your individual needs)
• To improve our MULA App (we continually strive to improve our App offerings based on the information and feedback we receive from you)
• To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs)
• To process transactions
• To administer a contest, promotion, survey or other site feature
• To send periodic notifications and information 

WHAT?  

Personal data we collect and share may include both information you provide and/or give consent for a third party to provide, including:

• Data on national identification card
• Account balances, payment history and transaction history
• Service usage data, such as data from mobile phone usage
• Personal scores and answers from psychometric questionnaire
• Other information you’ve filled out as part of application process

We collect data of your phone to provide a segmented risk profile and generate an aggregated statistical information. To protect your identity, we remove all personal identifiers (if any) and pseudonymise such information. Any metadata processed in this way cannot be used to reproduce the original data collected.

Metadata accessed, collected and shared are as follows: Contacts, Photos, Medias & Files and Calendar in the form of anonymous metadata uploaded to:  https://scoring.credolab.com. The anonymous information is accessed only once, collected in the form of metadata and is shared with and used by Credolab. MULA-X uses Credolab service to assess user’s credit worthiness. Credolab Pte Ltd is an authorized provider of data analytics service.  Credolab’s privacy policy is available at the following link: https://www.credolab.com/privacy-policies/gdpr-privacy-policy.

Note: For sensitive data, which is personal information regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal records, trade union memberships, biometric data, health records and sexual orientation or preferences, will be removed immediately if it is not required.

HOW?
All companies servicing customers need to share customers’ personal information in their normal operations. In the section below, we list the reasons the purposes companies can share their customers’ personal information and whether you can limit this sharing. In addition, there are certain rights you should be aware of under PDPA.

WHO?  

To render the service to you, as the Data Subject, under MULA-X Application (“MULA App”), we, as the Data Controller/Data Processor, disclose your personal information strictly under consent to its employees, its representatives, auditors, and external service providers under a contract with the Company, and Data Processors. Ie. GDS Link Asia Philippines Inc., 2C2P (Thailand) Co., Ltd., Sigma Infosolutions Limited (“Lendfoundry”), Oozou Limited, Credolab (Pte) Ltd, Innovative Assessments International, Ltd, Amazon Web Services, Appman Company Limited, Seen Digital Co. Ltd.  Specifically,  data collected is shared with Credolab Pte Ltd who is an authorized provider of data analytics services.  Data is uploaded to:  https://scoring.credolab.com.  MULA-X uses Credolab service to assess user’s credit worthiness. Metadata accessed, collected and shared are as follows: Contacts, Photos, Medias & Files and Calendar. Credolab’s privacy policy is available at the following link: https://www.credolab.com/privacy-policies/gdpr-privacy-policy.

We may disclose information (including personal information) about you to our subsidiaries and Affiliates. For purposes of this Privacy Policy, “Affiliates" means any person or entity which directly or indirectly controls, is controlled by or is under common control with MULA-X, whether by ownership or otherwise. Any information relating to you that we provide to our Affiliates will be treated by those Affiliates in accordance with the terms of this Data Privacy Policy. In addition, information disclosure may be required by the governmental agencies in accordance to the laws or government announcement. In such case, we will need to strictly obliged no matter consent is in place or not.  

WHY?  

We use the data collected by Credolab Pte Ltd as part of our decision process to assess your creditworthiness for a loan applications with us. We may also use your data to assess your interest in receiving financial services through algorithms and mathematical modelling.

TYPE OF CONSENTS AND IF YOU CAN LIMIT SHARING?

Reasons to share personal information

Consent to manage personal data 

To allow MULA-X to collect, process, share and cross-border transfer your personal information required for delivering service to you. 

Can you limit this consent while receiving service from MULA-X? NO.  

MULA-X can’t provide service to customers unless there in “consent to manage personal data” in place 

Consent to use personal data for product development

To allow MULA-X to use your personal information to develop and/or improve products and/or services that are better and suitable to your need 

Can you limit this consent while receiving service from MULA-X? YES.

Consent to use personal data for marketing purposeT

To allow MULA-X to use your personal information to communicate and notify you when there is right promotion or marketing campaign that may fit your need 

Can you limit this consent while receiving service from MULA-X? YES.

Consent to use personal data for credit modeling

To allow MULA-X to use your personal information to develop and improve its credit scoring model. 

Can you limit this consent while receiving service from MULA-X? YES.

How to limit sharing? 
You can limit or revoke personal data consents outlined above by going into “Information” in MULA-X Application (“MULA App”). After you limit or revoke the consents, the system will update your requests, and the usage of your personal information for such purpose will be disbanned immediately. 

Please note:If you are using MULA-X services and application, you may not limit or revoke “Consent to Manage Personal Data.” An action to limit or revoke this consent will disable your eligibility to receive further service. In the case you still have a loan outstanding, you cannot revoke “Consent to Manage Personal Data”.  

HOW DO WE MANAGE CUSTOMER’S PERSONAL INFORMATION How do we collect your information? 

MULA-X collects your information required to render our service from three main sources: 

1. Personal information provided by yourself, either through electronic capturing (e.g. using OCR technology to capture information on national identification card) or key-in information by yourself as part of application process
2. Transactional information obtained from your past transactions and historical activities on MULA-X Application
3. Information provided by 3rd parties such as service usage data, including data from mobile phone usage and personal scores and answers from psychometric questionnaire. 

What information do we collect? 
We collect information from you when you visit our app, register on our site, place an order, subscribe to our newsletter, respond to a survey or fill out a form.

• Name / Username
• Phone Numbers
• Email Addresses
• Password

We also collect information from mobile devices for a better user experience, although these features are completely optional: 

• Location (GPS): Location data helps to create an accurate representation of your interests, and this can be used to bring more targeted and relevant ads to potential customers.
• Phonebook (Contacts list): Your contacts list enables us to understand you (as user) better. 
• Camera (Pictures): Granting camera permission allows the user to download more applications via QR code and also enables you to participate in programmes that uses QR code. 
• Photo Gallery (Pictures): Granting photo gallery access allows the user to upload any picture to their photo gallery, such as receipts of transactions envisaged by the app.
• Calendar: Granting calendar access allows us to understand you better. 

Note: We have clear data life cycle for each type of information we collect. We will detain the information only during the required period, after which the information will be destroyed. 

How do we share your information? 
At MULA-X, data is shared only on need based and strict guideline. We use highly secured API technology for date transmission with a strong authentication and data encryption. 

How do we store your information? 
At MULA-X, we use cloud-based data warehouse of Amazon Web Service (“AWS”) in Singapore, where the standard of personal data protection maybe different from Thailand. We have obtained your consent to cross-border transfer your data to AWS data warehouse with proper data security measures. MULA-X has agreed on the standard with AWS to set petition and firewall to ensure data security. 

How Long Do We Keep Your Information?
We keep your information only so long as we need it to provide MULA App services to you and fulfill the purposes described in this policy. This is also the case for anyone that we share your information with and who carries out services on our behalf. When we no longer need to use your information and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either remove it from our systems or depersonalize it so that we can't identify you.

CUSTOMER’S RIGHTS AND PROTECTION Data Subject's Rights 

Under Thailand Personal Data Protection Act of 2019 (“PDPA”), you as the data subject have the following rights related to your personal information: 

• Right to access: Data subjects have a right to access and obtain a copy of their personal data from controllers and processors. 
• Right to information: Data subjects have a right to receive their personal data from controllers and processors in a readable format. 
• Right to object: Data subjects will have a right to object when their data is collected without fulfilling the consent requirements, or is being processed for direct marketing purposes, or is being processed for scientific, historical or statistical research purposes. There are exceptions that controllers and processors can rely on, such as the objection of the data subject can be overruled where the processing is necessary for public interest reasons.
• Right to erasure: Data subjects have a right to erasure available where the data of the data subjects must be deleted by the controller or processor if the data subjects withdraw their consent, or where data is no longer necessary for the purpose it was collected or processed for, or where data was collected unlawfully.
• Right to restriction of processing: Data subjects also have a right to request the restriction of the use of personal data. 
• Right to rectification: Data subjects have a right to request the rectification of their inaccurate data and have incomplete data stored about themselves completed.
• Right to data portability: Data subjects also have a right to request that data transmitted from one controller to another is in a readable format and can be used or disclosed by automatic means. 

How do we handle a breach?  

At MULA-X, we have assigned Khun Phisit Sucharitsopit, our Chief Information Officer as Data Protection Officer (“DPO”). Under our philosophy, we want to take proactive role to continuously review our Personal Data Protection Policy to ensure that customer’s information is always managed with highest security. In case there is any breach or potential issue, DPO will take immediate action to resolve the issue and report to the government within 72 hours. 

Contact UsVia Email: service@mula-x.comVia MULA App: “Support” Quick Access

Sale of or Reorganisation of Business
We reserve the right to transfer information to another Affiliate or third party in the event of a sale, merger or other transfer of all or substantially all of the assets of MULA-X or any of its Affiliates (as defined herein), or that portion of MULA-X or any of its Affiliates to which the MULA App service relates, or in the event that we discontinue our business or file a petition or have filed against us a petition in bankruptcy, reorganization or similar proceeding, provided that the Affiliate and/or third party agrees to adhere to the terms of this Data Privacy Policy.

Changes To Our Privacy Policy
We may change our MULA App service and policies, and hence we may need to make changes to this Data Privacy Policy so that they accurately reflect our MULA App services and policies. Unless otherwise required by law, we will notify you (for example through MULA App) before we make changes to this Data Privacy Policy and give you an opportunity to review them before they go into effect. Then, if you continue to use the MULA App service, you will be bound by the updated Data Privacy Policy. If you do not want to agree to this or any updated Data Privacy Policy, you can stop using the MULA App service and/or delete your account.

Governing Law
This Privacy Policy is governed by the laws of Thailand without regard to its conflict of laws provision. You consent to the exclusive jurisdiction of the courts in connection with any action or dispute arising between the parties under or in connection with this Data Privacy Policy except for those individuals who may have rights to make claims under Privacy Shield, or the Swiss-US framework.
The laws of Thailand, excluding its conflicts of law rules, shall govern this Agreement and your use of the MULA App. 

By using MULA-X or contacting us directly, you signify your acceptance of this Data Privacy Policy. If you do not agree to this Data Privacy Policy, you should not engage with our MULA App, website, or use our services. Continued use of the MULA App, direct engagement with us, or following the posting of changes to this Data Privacy Policy that do not significantly affect the use or disclosure of your personal information will mean that you accept those changes.

Data Privacy Policy | Version 3.0 | July 2021