Version 3.0

As of November 1st, 2026

BMW Leasing (Thailand) Co., Ltd. (“BMW,” “we,” “us,” or “our”) recognizes the importance of the protection of Personal Data which is any information relating to an identified or identifiable natural person. The high standards you expect from our products and services are our guideline for handling your data which may include the collection, use, disclosure, and/or transfer outside of Thailand. Our aim is to create and maintain the basis for a trusting business relationship with our customers and prospects. The confidentiality and integrity of your personal data is top priority for us.

This privacy policy ("Privacy Policy") applies to our websites, mobile applications, call center, social networking sites, online communication channels, events and activities, and other locations where we collect your Personal Data including the Personal Data of individuals associated with you (in the case of corporate customers). However, please read this Privacy Policy in conjunction with the terms and conditions of particular service that you use, which may set out separately regarding the personal information we collect about you.

We reserve the right to modify this Privacy Policy from time to time, so please review it frequently to see when this Privacy Policy was last revised. Any changes to this Privacy Policy will become effective when we post the revised Privacy Policy on our website or application. We will provide additional notice of significant updates.

1. What Personal Data we collect

We may collect or obtain the following types of information which may include your Personal Data directly or indirectly from you or other sources or through BMW AG, our affiliates, subsidiaries, other companies, or business partners. The specific type of data collected will depend on the context of your interactions with us, and the services or products you need or want from us and within BMW Group.

     1) Personal details, such as title, full name, gender, age, nationality, date of birth, marital status, occupation, job title, business type, income, years of service, information appearing on government-issued identification documents (e.g., national identification number, passport number, tax identification number, driving licence details or similar information), information in name or surname change documents, birth certificates, marriage certificates or divorce certificates, foreign national-related documents, work permits, certificates of residence, house registrations and title deeds, socio-cultural information, photographs, CCTV recordings, call recordings, life insurance information, visa-related documents, information in withholding tax certificates, VAT registration certificates, user profiles (e.g., configured news and audio service providers), and other legal documents;

     2) Sensitive Personal Data, we may collect, use or disclose your Sensitive Personal Data only to the extent necessary and relevant to providing products and services, considering applications, administering contracts, complying with laws, or establishing, exercising or defending legal claims, such as health information, disability, blood type, race, religion or beliefs, Biometric Data used to identify or authenticate an individual, including facial images used for identity verification, facial templates, face matching results and liveness detection results, and criminal record information (only where permitted by law or necessary to comply with applicable law). Such information may appear in documents you submit to us or may be obtained lawfully from other sources. We will process such data on the applicable legal basis, including obtaining your explicit consent where required by law, and will implement appropriate security measures and access restrictions;

     3) Contact details, such as postal address, delivery details, billing address, telephone number, fax number, map, location data, email address, LINE ID, Facebook account, Instagram ID, and other ID from social networking sites;

     4) Financial details, such as bank account details, bank statement, financed amount, financial contract information (e.g., amount of finance, contract type, contract status, down payment, balloon amount, installment, guarantor name, down payment term, product type, balloon payment behavior), cheque details, NCB record, securities instrument details, details of deposit, tax amount, outstanding balance, arrears amount relating to debt collection, financial statement, company affidavit, shareholder lists and other financial related information;

     5) Vehicle details, such as Vehicle Identification Number (VIN), license plate number, brand, model, year, color, engine number, chassis number, vehicle type, mileage, battery, voltage, door and hatch status, oil level, brake wear, position and movement data (e.g. time, position, speed), traffic information, environmental information, sensor information (e.g., radar, ultrasonic devices, gestures, voice), details of car insurance, credit life insurance, compulsory insurance and gap insurance, residual value, accessories, bluebook, vehicle price, due date of next service visit, vehicle check-up documents, details of ConnectedDrive and its operation, GPS coordinate and vehicle location, vehicle history report, police summons and letters, and other vehicle related information;

     6) Transaction details, such as details of payments to and from you, payment date and/or time, payment amount, refund request details, the date and place where products or services were purchased, the address, date and time for collection or delivery, service request forms, acknowledgements, recipient signatures, receipts, invoices, transactions, transaction history, location, transaction status, purchasing behaviour, and other details of products and services you have purchased, deposit slips or payment slips, payment cards, complaints and claims, intended purchase time, and outstanding debt;

     7) Technical details, such as Internet Protocol (IP) address and telemetry data;

     8) Behavioural details, such as information about your behaviour, lifestyle, attitudes and other interaction data;

     9) Profile details, such as your ConnectedDrive account, MyBMW account, MyMINI account, login name or username, profile details, photographs, contact history, complaint history, previous orders, order history, your interests, preferences, feedback and responses to customer satisfaction surveys;

     10) Marketing and communication details, such as your choices regarding receipt of marketing information from us, our affiliates, subsidiaries, third parties and business partners, and your communication preferences; and/or

     11) Other information collected, used or disclosed by BMW in connection with our relationship with you, such as contract information (e.g., contract number, contract type and retention period), application forms or questionnaires. If you provide Personal Data of any third party to us, e.g., their name, family name, address details, and telephone number for emergency contact and debt collection, family member income; please provide this Privacy Policy for their acknowledgement and/or obtaining consents where applicable.

We only collect the information of children, quasi-incompetent persons, and incompetent persons where their parent or guardian has given their consent. We do not knowingly collect information from customers under the age of 20 without their parental consent when it is required, or from quasi-incompetent persons and incompetent persons without their legal guardian's consent. In the event we learn that we have unintentionally collected personal information from anyone under the age of 20 without parental consent when it is required, or from quasi-incompetent persons and incompetent persons without their legal guardians, we will delete it immediately or process only if we can rely on other legal bases apart from consent.

2. Why we collect, use and/or disclose your Personal Data

     2.1 The purpose of which you have given your consent:

Marketing and Communications: To provide marketing, re-marketing, re-targeting, segmentation, communications, sales, special offers, promotions, notices, news, information about other products and services from BMW Group, our affiliates, subsidiaries and/or business partners which we cannot rely on other legal bases.

We will seek your consent from time to time if we are required under the applicable data protection law. Giving or withholding consent for marketing purposes will not affect the consideration of your application, entry into a contract, or your use of our core products and services. You may also select the categories of recipients or communication channels from the options we make available.

     2.2. The purposes we may rely on and other legal grounds for processing your Personal Data

We may also rely on (1) contractual basis, for our initiation or fulfilment of a contract with you; (2) legal obligation, for the fulfilment of our legal obligations; (3) legitimate interest, for the purpose of our legitimate interests and the legitimate interests of third parties; (4) vital interest, for preventing or suppressing a danger to a person’s life, body, or health; (5) public interest, for the performance of a task carried out in the public interest or for the exercising of official authorities, and/or (6) other legal grounds permitted under applicable data protection law as the case may be.

Depending on the context of the interactions with us, we may collect, use, and/or disclose your Personal Data for the following purposes:

1) To consider your application, provide products and services, and manage our contractual relationship with you: To enter into a contract and manage our contractual relationship with you (including contract activation, implementation, re-agreement, early termination and end-of-term management); to book a test drive; to provide vehicle registration and other registration services; to deliver welcome packages, contract details, financial transactions and payment-related services, including transaction checks, verification and cancellation; to send reminder letters and SMS; to consider loan offerings and credit scoring; to conduct know-your-customer and customer due diligence (KYC/CDD), including identifying, verifying and authenticating identity; identifying beneficial owners and related persons; screening against relevant databases or lists; assessing and rating customer risk; and conducting ongoing review and transaction monitoring in accordance with applicable laws and requirements, including identity verification and authentication by the methods described in item 5) where necessary; to support and perform other activities related to such services or products, including processing your orders, deliveries, collections, returns, refunds and exchanges; to provide delivery updates, maintenance and vehicle repair bookings; to provide basic ConnectedDrive services (e.g., teleservices or intelligent emergency calls); to provide mobility services (roadside assistance); to process receipt issuance, cash disbursements, accounts payable, invoices and proof of purchase; to issue bill payment cards; to process insurance premium payments, insurance arrangements and related services; to send reminders for insurance policy renewals; to buy or sell used vehicles or offer auctions; to conduct vehicle auctions; to notify you of vehicle recalls; to allocate overdue customers for debt collection, offer refinancing or handle vehicle repossession; to offer appropriate solutions for customers in default; to mitigate financial loss, manage debt portfolios and provide after-sales services;

2) Marketing and Communications: To provide marketing, re-marketing, re-targeting, market segmentation, communications, sales, special offers, promotions, discounts, membership privileges and benefits, loyalty campaigns, rich menus, notices, news, and information about other products and services from the BMW Group, our affiliates, subsidiaries, authorized dealers and sales representative agencies, and/or our selected business partners, in accordance with preferences you have expressed directly or indirectly, or other promotions that may benefit you; to provide information, alerts or services relating to vehicle models or test drives; to provide service-due alerts and online booking services; and to provide online quotations and specific quotations with tailored details that may be of interest to you;

3) Participating in contests, prize draws and similar promotion: To allow you to participate to promotions, special offers, privilege, lucky draws, and other offers/promotions (e.g. for sending you reminder emails, transferring your Personal Data to fulfilment partners), technical campaign, activities, events and seminars, re-marketing, re-targeting and all related advertising services; to process and administer your account registration, gift registration, and event registration; to examine your entire user history, both online and offline; to process on your VISA application and facilitate you on overseas events/trips or incentive trips;

4) Recommendations and Personalization: To recommend products and services that might be of interest to you, identify your preferences, and personalize your experience;

5) Registration, Identification Verification and Authentication: To register, verify, identify, and authenticate you or your identity when you access our services, systems or channels, including comparing a facial image against an identity document and performing liveness detection to prevent impersonation and fraud. Where such activities involve the processing of Biometric Data, we will obtain your explicit consent or rely on an applicable legal exception, as the case may be;

6) To contact and communicate with you: To provide you with marketing communications, sales, special offers, promotions, notices, news, and information about the products and services; to process and update your information.

7) To manage our relationship with you: To communicate with you in relation to the products and services you obtain from us, within BMW Group, our affiliates, subsidiaries, and from our business partners; to process and update your information as our member; to facilitate your use of the products and services; to handle customer service-related queries, request, feedback, complains, warranty claims, disputes or indemnity; to deal with technical issues, provide technical assistance, car repairing, warranty and goodwill; to conduct customer relationship management activities (e.g., customer satisfaction index survey);

8) Profiling and data analytics: To measure your engagement with the products and services; to undertake data analytics for products and services development, market research, surveys, assessments, behavior, statistics and segmentation, consumption trends and patterns; to know you better; to improve business performance and better adapt our content to the identified preferences of our customers; to determine the effectiveness of our promotional campaigns; to identify and resolve of issues with existing products and services, and qualitative information development; we may also conduct profiling from the data that we receive within BMW Group, our dealers and other sources which you have interact with or related to us directly or indirectly;

9) Research, development and improvement of business operations, products, services, systems and processes: To evaluate, test, develop, manage, improve, research and develop services, products, systems, service channels and business operations for you, all our customers and within the BMW Group, including but not limited to our authorized dealers, sales representative agencies and business partners; to measure the performance of physical products, digital properties and marketing campaigns; to manage target groups, lead generation and sales funnels; to assure product and service quality; to obtain legal advice; to create aggregated and anonymized reports; to identify and resolve issues; to conduct training programs for sales personnel; and to improve application, sales and service processes, as well as the efficiency and quality of our operations and those of BMW Group companies, including preparing statistical reports and analytical information in aggregated or non-identifiable form to identify and address issues, assure quality and improve customer experience;

10) To learn more about you: To learn more about the products and services you receive, and other products and services you may be interested in receiving, including profiling based on the processing of your Personal Data, for example, by looking at the types of products and services that you use from us, how you like to be contacted and so on; to learn from the satisfaction survey and customer credit evaluation;

11) Functioning of our sites, mobile application, and platform: To administer, operate, track, monitor, and manage our sites, application and platform to facilitate and ensure that they function properly, efficiently, and securely; to facilitate your experience on our sites and platform; improve layout, and content of our sites and platform;

12) IT Management: For our own business management purpose including for our IT operations, management of communication system, operation of IT security and IT security audit; internal business management for internal compliance requirements, policies, and procedures;

13) Compliance with regulatory and compliance obligations: To comply with applicable laws, legal proceedings or orders of government authorities, including orders of authorities outside Thailand, and/or cooperate with courts, competent authorities, government agencies and law enforcement agencies where we reasonably believe that the law requires us to do so and disclosure of your Personal Data is necessary to comply with such law, proceeding or government order; to provide and administer VAT refund services; to issue full tax invoices or tax forms; to record and monitor communications; to handle traffic tickets and road tax; to report transactions to the Anti-Money Laundering Office (AMLO); to submit information to the credit bureau and issue credit bureau letters to you; to disclose information to tax authorities, financial services regulators and other government and law enforcement authorities; and to investigate or prevent crime;

14) Protection of our interests: To protect the security and integrity of our business; to exercise our rights or protect our interest where it is necessary and lawfully to do so, for example, to detect, prevent, and respond to fraud claims, intellectual property infringement claims, or violations of law; to manage and prevent loss of our assets and property; to secure the compliance of our terms and conditions; to detect and prevent misconduct within our premises which includes our use of CCTV; to follow up on incidents; to prevent and report criminal offences; to protect the security and integrity of our business;

15) Fraud detection: To verify your identity, and to conduct legal and other regulatory compliance checks (for example, to comply with anti-money laundering regulations, and prevent fraud). This includes to perform internal audits and records, asset management, fraud database, system, and other business controls;

16) Corporate transaction: in the event of sale, transfer, merger, reorganization, or similar event we may transfer your information to one or more third parties as part of that transaction;

17) Risks: To perform risk management, audit performance, and risk assessments;

and/or

18) Life: To prevent or suppress a danger to a person’s life, body, or health.

19) Automated systems, artificial intelligence and predictive analytics: In carrying out the purposes described in this section, we may use automated systems, artificial intelligence, machine learning or similar technologies to analyze, assess, classify or predict your Personal Data, including to support service delivery, credit and affordability assessments, customer relationship management, risk management, fraud detection, process improvement, and product and service development. Where we use automated processing that produces legal effects or similarly significantly affects you, we will comply with applicable law and implement appropriate measures to protect your rights and interests, including channels for you to request a review of the decision, express your views or contest the decision as provided by law. Where outputs from such systems are used to support decisions, we will provide appropriate human oversight and review as required by applicable law.

If you fail to provide your Personal Data when requested, we may not be able to provide our products and services to you. Additionally, this may affect the compliance with any laws that we or you are obligated to comply with.

3. To whom we may disclose or transfer your Personal Data

We may disclose or transfer your Personal Data to the following third parties who collect, use and disclose Personal Data in accordance with the purpose under this Policy. These third parties may be located in Thailand and areas outside Thailand. You can visit their privacy policy to learn more details on how they collect, use and disclose your Personal Data as you are also subject to their privacy policies.

     3.1. BMW Group's data ecosystem

As BMW Leasing (Thailand) Co., Ltd. is part of the BMW Group (which includes companies in Thailand and overseas under BMW AG) whose companies collaborate and provide customer services and systems, including website-related services and systems, we may need to transfer your Personal Data to, or otherwise allow access to such Personal Data by, other companies within the BMW Group for the purposes set out in this Privacy Policy. The BMW Group companies to which we may disclose or transfer your Personal Data are listed in the table of BMW Group companies, affiliates and business partners in section 3.3.

     3.2. Our service providers

We may use other companies, agents or contractors to perform services on behalf or to assist with the provision of products and services to you. We may share your Personal Data to our service providers or third-party suppliers including, but not limited to (1) internet, software, website developer, digital media, IT service providers and IT maintenance & support company; (2) logistic and courier service providers; (3) payment and payment system service providers; (4) research and market surveillance agencies; (5) analytics service providers; (6) survey agencies; (7) auditors; (8) marketing, advertising media, designer, creative, and communications agencies; (9) call center; (10) campaign, event, and market organizers, and CRM agency; (11) telecommunications and communication service providers; (12) outsourced administrative service providers; (13) data storage and cloud service providers; (14) printing service providers; (15) insurance company and broker; (16) registration service providers; and/or (17) auction house service provider.

In the course of providing such services, the service providers may have access to your Personal Data. However, we will only provide our service providers with the information that is necessary for them to perform the services, and we ask them not to use your information for any other purposes. We will ensure that the service providers we work with will keep your Personal Data secure as required under the laws.

     3.3. List of BMW Group companies, affiliates and our business partners

We may transfer your Personal Data to our business partners to conduct business and provide services relating to banking, finance, credit, loans, vehicles, insurance, telecommunications, marketing, retail, wholesale, equipment rental, including platform sellers or providers, or other businesses with which we may jointly offer products or services, or whose products or services may be offered to you. The BMW Group companies, affiliates and business partners to which we may disclose or transfer your Personal Data are set out below. We will disclose or transfer Personal Data to the listed companies only to the extent necessary and in accordance with the purposes and legal bases described in this Privacy Policy. We may update the list from time to time and will notify data subjects in advance in accordance with the criteria and within the period prescribed by law.