Privacy Policy

1. Scope and our role

This policy covers our website, enquiries, recruitment and our telesales services, in which we contact the existing customers of brands that hire us to upsell, cross-sell and resell, using data from those brands’ CRM systems, by phone, LINE, email and social media.

When we contact customers on behalf of a brand or business that hires us (a “client”), the client is the data controller and we are a data processor acting only on its instructions and our agreement with it.

For our own activities, such as answering enquiries made through our website or channels, recruitment and managing client contracts, we are the data controller.

2. Data we collect

Contact data: name, phone number, email, company, job title and the messages you send us by phone, email, LINE Official Account or social media.

Data from the client’s CRM: name, phone number, purchase history and other data the client sends us within the scope of work.

Call and conversation data: call date, time and duration, call outcome, products or services you are interested in or order, answers you give, requests not to be contacted again, and chat or email content.

Call recordings: if a call is recorded, we tell you before recording starts and explain why it is recorded.

Job applicant data: name, contact details, education and work history, application documents and interview results.

Website technical data: basic data needed to deliver and secure the website, such as IP address and browser type, processed by Cloudflare, our hosting provider. This website has no forms, no visitor analytics and no cookies.

3. Where data comes from

From you directly; from the CRM of the client, which is a brand you have bought from or used before; or from the channels you use to reach us, such as LINE, Facebook and Instagram.

Clients are responsible for having a valid lawful basis to collect and share their customer lists with us. If you want to know where we obtained your data, ask us using the details in section 12 and we will tell you which client it relates to.

4. Purposes and lawful basis

To provide telesales under our client agreements: offering products or packages that fit your purchase history (upsell and cross-sell), inviting you to buy again (resell), taking orders, answering questions and recording call outcomes back into the client’s CRM.

To answer enquiries and call back, consider job applications, manage contracts, control service quality, train staff, prevent fraud and comply with the law.

For work done on behalf of a client, the client must have a valid lawful basis for each marketing purpose; our services agreement with the client does not by itself authorise marketing to you. For our own activities we rely on performance of a contract or steps before entering one, legitimate interests balanced against your rights, legal obligations, and consent where the law requires it.

We do not sell personal data, and we do not use data received from a client for our own purposes or for any other client.

5. Asking us not to call again

You may object to direct marketing at any time, by telling our staff during a call or using the details in section 12. We stop using your data for the direct marketing you object to across all relevant channels and pass the objection on to the client.

Our staff never need your passwords, one-time codes or PINs for any account. Do not give them out on a call. If you are not sure a call really came from us, contact us on 02 055 6551 or LINE @iam-okie.

6. Disclosure

We share data only as needed with the client we are working for, the staff involved, the service providers we use, such as telephone systems, customer-management systems, cloud, email and messaging platforms like LINE and Meta, and government bodies or others with legal authority.

Some providers may store data outside Thailand. We transfer data abroad only where the conditions of the Personal Data Protection Act are met.

7. Retention

We keep data only as long as needed for its purpose. Data processed for a client, including call recordings, is kept and deleted according to the client’s lawful instructions and the law.

Job applicant data is kept only as long as needed for recruitment, and longer for future openings only with your consent. Records the law requires, such as accounting and tax records, are kept for the legal period.

8. Security

We apply technical and organisational measures appropriate to the risk. If a personal data breach occurs: as a processor, we notify the client who controls the data; as a controller, we notify Thailand’s Personal Data Protection Committee without delay and, where feasible, within 72 hours, unless the breach is unlikely to risk people’s rights, and we also notify the people affected when the risk is high.

9. Your rights

Subject to legal conditions, you may request access to and a copy of your data, correction, deletion or destruction, restriction, objection to processing including direct marketing, receipt or transfer of your data, and withdraw consent without affecting earlier processing. You may also complain to Thailand’s Office of the Personal Data Protection Committee.

For data we process on behalf of a client, we pass your request to that client and help carry it out on its instructions. We may ask for proportionate information to verify your identity and handle requests within the legal time limits.

10. Minors

Where processing a minor’s data relies on consent, section 20 of the Personal Data Protection Act applies, including consent from the holder of parental responsibility where required. If you are a parent or guardian and believe we hold a minor’s data without legal authority, contact us so we can check.

11. Changes

We may update this policy to reflect our services or the law. The latest revision date appears on this page. We give further notice of material changes where the law requires.