Privacy Policy
Last updated: March 19, 2026 | Effective: March 19, 2026
1. Introduction
TrustFinance Awards ("we," "us," or "our") operates the TrustFinance Awards platform (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR – Regulation 2016/679) and the Thailand Personal Data Protection Act B.E. 2562 (PDPA).
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use our services.
2. Data Controller
TrustFinance Ltd. is the data controller responsible for your personal data.
- Registered Address: [Company Address]
- Email: privacy@trustfinance.com
- Data Protection Officer (DPO): dpo@trustfinance.com
3. Definitions
- Personal Data — any information relating to an identified or identifiable natural person ("Data Subject").
- Processing — any operation performed on personal data (collection, recording, storage, use, disclosure, erasure, etc.).
- Consent — any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes.
- Data Processor — a natural or legal person who processes personal data on behalf of the Data Controller.
4. Personal Data We Collect
4.1 Data You Provide Directly
- Account Information: name, email address, password (hashed), display name.
- Nomination Data: company name, company details, category selection, nominator contact information.
- Contact & Partnership Inquiries: name, email, company, message content, inquiry type.
- Newsletter Subscription: email address.
4.2 Data Collected Automatically
- Voting Data: vote records, category selections, timestamps, and associated IP addresses (for fraud prevention).
- Usage Data: pages visited, time spent, referral sources, browser type, operating system, device identifiers.
- Cookies & Tracking Technologies: session cookies, analytics cookies (see Section 10).
- Log Data: server logs including IP address, access times, and error logs.
4.3 Data from Third Parties
- Social Login: if you sign in via third-party providers (e.g., Google), we receive your public profile information and email address as authorized by you.
- Analytics Providers: aggregated usage statistics from analytics services.
5. Legal Basis for Processing (GDPR Art. 6 / PDPA Sec. 24)
| Purpose | Legal Basis |
|---|---|
| Account creation & management | Performance of contract |
| Processing votes | Performance of contract |
| Fraud prevention & IP logging | Legitimate interest |
| Newsletter & marketing emails | Consent |
| Analytics & platform improvement | Legitimate interest |
| Legal compliance | Legal obligation |
| Partnership & sponsorship inquiries | Consent / Legitimate interest |
6. Purposes of Processing
We process your personal data for the following purposes:
- To provide, maintain, and improve the Platform and award services.
- To process and validate votes, nominations, and award results.
- To communicate award results, updates, and relevant industry news (with your consent for marketing).
- To detect and prevent fraudulent voting, bot activity, and vote manipulation.
- To respond to inquiries, partnership requests, and support tickets.
- To generate aggregated, anonymized industry reports and statistics.
- To comply with legal and regulatory obligations.
- To enforce our Terms of Service.
7. Data Sharing & Disclosure
We do not sell your personal data. We may share your data with:
- Service Providers (Data Processors): hosting providers, email delivery services, analytics platforms — all bound by Data Processing Agreements (DPAs) under GDPR Art. 28 / PDPA Sec. 40.
- Award Partners: aggregated, anonymized voting statistics may be shared with industry partners for reports. No personally identifiable information is disclosed without consent.
- Legal Authorities: when required by applicable law, court order, or governmental request.
- Business Transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred. You will be notified of any such change.
8. International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA) or Thailand. In such cases, we ensure adequate safeguards are in place:
- GDPR: Standard Contractual Clauses (SCCs) approved by the European Commission, or adequacy decisions (GDPR Art. 46).
- PDPA: Data transfers comply with PDPA Sec. 28, ensuring the destination country has adequate data protection standards or appropriate safeguards are in place.
9. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion + 30 days |
| Voting records | Duration of the award edition + 3 years (for audit) |
| IP addresses (fraud prevention) | 90 days after the voting round ends |
| Newsletter subscriptions | Until unsubscribe |
| Contact/partnership inquiries | 2 years from submission |
| Analytics (aggregated) | Indefinitely (anonymized) |
| Server logs | 90 days |
After the retention period, personal data is securely deleted or irreversibly anonymized.
10. Cookies & Tracking Technologies
We use the following types of cookies:
- Strictly Necessary Cookies: required for authentication, security, and basic Platform functionality. Cannot be disabled.
- Analytics Cookies: help us understand Platform usage (e.g., page views, user flows). Collected with your consent.
- Marketing Cookies: used to deliver relevant content and measure campaign effectiveness. Requires explicit consent.
You can manage your cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may affect Platform functionality.
11. Your Rights
Under GDPR and PDPA, you have the following rights regarding your personal data:
| Right | Description | GDPR | PDPA |
|---|---|---|---|
| Access | Request a copy of your personal data | Art. 15 | Sec. 30 |
| Rectification | Correct inaccurate or incomplete data | Art. 16 | Sec. 35 |
| Erasure | Request deletion of your data ("right to be forgotten") | Art. 17 | Sec. 33 |
| Restriction | Restrict processing of your data | Art. 18 | Sec. 34 |
| Data Portability | Receive your data in a structured, machine-readable format | Art. 20 | Sec. 31 |
| Object | Object to processing based on legitimate interests or direct marketing | Art. 21 | Sec. 32 |
| Withdraw Consent | Withdraw consent at any time (without affecting prior lawful processing) | Art. 7(3) | Sec. 19 |
| Lodge a Complaint | File a complaint with a supervisory authority | Art. 77 | Sec. 73 |
To exercise any of these rights, contact us at privacy@trustfinance.com. We will respond within 30 days (GDPR) or 30 days (PDPA) of receiving your verified request.
12. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
- Secure password hashing (bcrypt/argon2).
- Role-based access controls (RBAC) for internal systems.
- Regular security audits and vulnerability assessments.
- Incident response procedures with 72-hour breach notification (GDPR Art. 33 / PDPA Sec. 37(4)).
13. Children's Privacy
The Platform is not intended for individuals under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will promptly delete it.
14. Automated Decision-Making & Profiling
We use automated systems for vote fraud detection (e.g., IP-based duplicate detection, pattern analysis). These systems may flag votes for manual review. You have the right to contest automated decisions and request human review under GDPR Art. 22 and PDPA Sec. 21.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email notification or a prominent notice on the Platform at least 14 days before they take effect. Continued use of the Platform after changes constitutes acceptance of the updated policy.
16. Supervisory Authorities
- EU/EEA: You may lodge a complaint with your local Data Protection Authority (DPA). A list of DPAs is available at edpb.europa.eu.
- Thailand: You may file a complaint with the Personal Data Protection Committee (PDPC) at pdpc.or.th.
17. Contact Us
For any privacy-related questions, data requests, or complaints:
- General Privacy: privacy@trustfinance.com
- Data Protection Officer: dpo@trustfinance.com
- Postal: TrustFinance Ltd., [Registered Address]