Brilliant & Million
Website Privacy Notice

Brilliant & Million Co., Ltd. (“we,” “us,” or “our”) offers creative marketing solutions including strategy development, content creation, design solutions, digital communications, media and customer relationship management solutions, technology solutions and development, and marketing operations services. This Privacy Notice sets out how we collect, use, share, and protect any information we collect through this website (“Website”). This Privacy Notice also explains the measures we take to safeguard your information and describes how you may contact us regarding our privacy practices.

Introduction

Any data collected through this Website, including personal data (as defined under applicable data protection laws, referred to collectively as “Personal data”), will only be used for the purposes set out in this Privacy Notice. Notwithstanding, we may use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law. When data is collected on this Website, Brilliant & Million Co., Ltd. is acting as a data controller.

Please read this Privacy Notice thoroughly. If you disagree with the way personal information will be used, please do not use this Website.

We may include links to other websites or embedded content, including social media platforms. This Privacy Notice only covers this Website and does not apply to the data practices of other websites or platforms. We encourage you to read the privacy notices available on other websites you visit.

SUMMARY

WHAT PERSONAL DATA DO WE COLLECT AND PROCESS THROUGH THE WEBSITE?
1
PURPOSE OF DATA COLLECTION AND LEGAL BASIS
2
WITH WHOM DO WE SHARE PERSONAL DATA?
3
YOUR RIGHTS AND CHOICES REGARDING YOUR PERSONAL DATA
4
CHILDREN
6
DATA SECURITY
6
DATA TRANSFERS
6
USE OF COOKIES, OTHER TRACKING TECHNOLOGY, SOCIAL MEDIA AND SOCIAL MEDIA PLUG-INS
6
NOTIFICATION OF CHANGES
7
FURTHER INFORMATION
7

1. What personal data do we collect and process through the Website?

The following table describes the categories of personal data we collect.

Category of Personal data	List of personal data processed
Contact Information and Identifiers	First name, last name, e-mail address, and telephone number
Internet or other electronic network activity information (Technical data)	Cookie data, limited to IP address tracking
Geolocation data	Location information from your IP address
Your verbatim communications to us or shared on the public areas of our site	Information that you directly send us by contacting us through the channels listed on the “Contact Us” portion of this Website

Sources of personal data that we may collect:

We may collect the Personal data outlined above from the following sources:

• Directly from you, for example, when you send us your job application, questions or comments, or make usage of your privacy rights.


• Indirectly from you by using automated technologies, such as cookies, pixels, third party tags, scripts, log files and other means to automatically collect information about the use of our Website.


2. Purpose of data collection and legal basis

The following table provides information about our purposes and legal basis for collecting your personal data:

Our Purposes for collecting and using your personal data	Basis for processing
To read and respond to your queries to us.	Depending on your request, we will rely on our legitimate interest or the performance of pre-contractual measures to respond to individuals’ queries.
When you contact us through the data access request form	We rely on our legal obligation to provide you a process to exercise your rights.
Operating our Website, for example, operating, analyzing, improving, and securing our Website.	We rely on your consent to obtain your personal data through cookies. For visitors from other geographies, we rely on our legitimate interest to improve our services and develop new products.

As indicated below, vendors and other parties may act as our service providers, or in certain contexts, independently decide how to process your information. We encourage you to familiarize yourself with and consult their privacy policies and terms of use.

3. With whom do we share personal data?

We will share your personal data for various business purposes, with other entities of the Publicis Groupe, and service providers.
The table below shows how and with whom we may share or disclose your personal data.

Category	Categories of Parties With Whom We Share Your Data
Contact Information and Identifiers	Affiliates, recruitment service providers, privacy services providers.
Your verbatim communications to us or shared on the public areas of our site	Affiliates, recruitment service providers, and privacy services providers.

We also may share any of the personal data we collect with the following

Sharing for Legal Purposes: In addition, we may share personal data with other parties in order to: (a) comply with legal process or a regulatory investigation (e.g. regulatory authorities’ investigation, subpoena, or court order); (b) enforce our Terms of Service, this Privacy Notice, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of other parties; and/or (d) protect the rights, property or personal safety of us, our platform, our customers, our agents and affiliates, its users and/or the public. We likewise may provide information to other companies and organizations (including law enforcement) for fraud protection, and spam/malware prevention, and similar purposes.

Sharing In Event of a Corporate Transaction: We may also share personal data in the event of a major corporate transaction, including for example a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets, or for purposes of due diligence connected with any such transaction.

Aggregate, Deidentified, or Anonymised Information: We may aggregate, de-identify and/or anonymise any information collected so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any other party, including advertisers, promotional partners, and sponsors, in our discretion, unless otherwise prohibited by applicable law

4. Your rights and choices regarding your personal data

Please use this LINK if you want to make use of any of your below mentioned legal rights.

1. GENERAL

Subject to certain exceptions and the jurisdiction in which you live, if you are a resident of the EU, the GDPR provides you with specific rights regarding your personal data. This subsection describes your rights and explains how to exercise those rights regarding personal data that we hold about you. These rights include:

• The right of access:
  You can access all Personal Data we hold about you, know the origin of this Personal Data and obtain a copy in an understandable format. You may also use your right to access your Personal Data to control the exactness of the data and have them rectified or deleted. You have no justification to provide to exercise your right to access;


• The right to rectification:
  In order to avoid that inaccurate or incomplete Personal Data relating to you is process or shared, you can ask us to rectify it;


• The right to erasure:
  You may request the erasure or deletion of the Personal Data we hold on you. This is not an absolute right since we may have to keep your Personal Data for legal or legitimate reasons. You may, for example, exercise your right to deletion in the following cases:
  
  
  • if you have withdrawn your consent to the processing (see below);
  
  
  • when data is not or is no longer necessary for the purposes for which it was initially collected or processed;
  
  
  • the data is processed unlawfully (e.g., publishing hacked data).


• The right to object to the processing of your Personal Data:
  When we process your Personal Data based on our legitimate interest or in the public interest, you may at any time object to the processing of your Personal Data for reasons relating to your personal situation. We may nevertheless, on a case-by-case basis, reject such a request by pointing out compelling legitimate reasons justifying the processing of this data which prevail on your interests, rights and freedoms, or when this data is necessary to establish, exercise or defend a right before a Court.


• The right to restrict processing:
  The right to limit the processing completes your other rights. This right means that the data processing relating to you and that we are performing is limited, so that we may keep this data, but we cannot use it or process it in any other manner. This right applies in specific circumstances, i.e.:
  
  
  • if you challenge the exactness of your Personal Data. The processing is then limited for a period of time so that the agency may verify the exactness of the Personal Data;
  
  
  • if the processing is unlawful and you object to the erasure of your Personal Data and request instead that its use be limited;
  
  
  • if we do not need the Personal Data for the purposes mentioned above in Section I anymore, but you still need it to establish, exercise or defend rights before a Court; and
  
  
  • in the cases where you objected to the processing which is based on the legitimate interests of the agency, you may ask to limit the processing for the time necessary for us to verify if we can accept your objection request (i.e., the time necessary to verify whether the legitimate reasons of the agency prevail over yours).


• Right to object to data processing for direct marketing purpose
  You may unsubscribe or object, at any time and without any justification, to the reception of direct marketing communications. Simply either (i) click on the link in the footer of the communications you receive from us; or (ii) use the hyperlink above; or (iii) send us an email at the email address set out in the “Further Information” section below with the word unsubscribe in the subject field of the email.


• The right to data portability:
  You may request to retrieve the Personal Data you provided us with, in a structured, commonly used and machine-readable format, for personal use or to share them with a third party of your choice.
  
  This right only applies to Personal Data you provided us with, directly or indirectly, and which was processed through automated means, if this processing is based on your consent or the performance of a contract. Please check the list of our Personal Data processing activities’ legal grounds (in Section II of this Privacy Notice) to know whether our processing is based on the performance of a contract or on consent.


• The right to withdraw your consent to the processing of your personal data at any time:
  You may read Section II of this Privacy Notice in order to identify the purposes for which the processing of your Personal Data is based on your consent;



If you are unsatisfied with the way we process your Personal Data or if your request has been rejected, you may also lodge a formal complaint with your local competent data protection authority.

Personal data will be stored in accordance with our applicable data retention requirements and corporate policies. The retention period for personal data varies depending on the type of personal data and the purposes of processing it.

You can exercise your rights by using the link above. We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way. If we cannot fully address your request, we will contact you to let you know and explain the reason why your request was denied.

2. INFORMATION FROM OUR CLIENTS

If personal data about you has been processed by us as a processor on behalf of a client and you wish to exercise any rights you have with such personal data, please inquire with our client directly. If you wish to make your request directly to us, please provide the name of our client on whose behalf we processed your personal data. We will refer your request to that client, and will support them to the extent required by applicable law in responding to your request.

5. Children

The Website is intended for general audiences and is not directed at children. We do not knowingly collect personal data from children.

6. Data Security

We use a variety of methods, such as firewalls, intrusion detection software and manual security procedures, designed to secure your data against loss or damage and to help protect the accuracy and security of information and to prevent unauthorized access or improper use. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you. If you think that the Website or any personal data is not secure or that there has been unauthorized access to the Website or your personal data, please contact info@brilliantmillion.com immediately.

7. Data Transfers

Due to the international nature of our business, your Personal Data may be transferred outside of the Kingdom of Thailand.

Your Personal Data may be transferred to countries not considered to have the same level of data protection as in Thailand. However, we ensure all data transfers comply with applicable legal requirements by executing standard contractual clauses. Should you wish to know more about how your Personal Data is protected or wish to request a copy of the contractual protections please contact privacyofficer@publicisgroupe.com.

8. Use of cookies and other tracking technology

Cookies are small pieces of text or code sent to your device when you visit the Website. Cookies are used to optimize the viewing experience, count visitors to a webpage, troubleshoot any problems, keep websites secure, and better serve content. The following cookies are used on our Website:

• Session cookies to help serve this Website to you more quickly and improve navigation through the Website. They are deleted once you leave our Website or close your browser window.


9. Notification of changes

Any changes to this Privacy Notice will be promptly communicated on this page and you should check back to see whether there are any changes. Continued use of the Website after a change in the Privacy Notice indicates your acknowledgement and acceptance of the use of Personal Data in accordance with the amended Privacy Notice.

10. Further Information

If you consider that we are not complying with this Privacy Notice, if you have any questions in relation to this Privacy Notice, or have questions about your rights and choices, please contact info@brilliantmillion.com. You may also lodge a formal complaint with your competent data protection authority.

If you have any questions about Brilliant & Million's data practices or you wish to exercise your rights or know about the contractual protections in place, please contact the Publicis Chief Data Privacy Officer on privacyofficer@publicisgroupe.com.

Last Updated: 20 September 2022