Privacy Policy

1. Data controller

Prospera Nexus Company Limited, registration no. 0105569181481.

Address: No. 25, Alma Link Building, Room 808, 17th Floor, Soi Chidlom, Ploenchit Road, Lumpini, Pathum Wan, Bangkok, Thailand.

General email: cs@prosperanexus.com Tel. 093-737-3482 (+66 93 737 3482).

Data Protection Officer (DPO): dpo@prosperanexus.com, same address.

This policy is issued under section 23 of the Personal Data Protection Act B.E. 2562 (2019) and related laws.

2. Scope

Applies to the website www.prosperanexus.com, the official Prospera Nexus app (once launched), customer service channels and performance of loan agreements. This website does not collect copies of ID cards; loan applications are made only in the app.

3. Data we collect

3.1 Identity data: full name, date of birth, nationality, national ID number, registered address, contact address, electronic signature.

3.2 Contact data: phone number, email.

3.3 Financial data: self-declared income, bank account, borrowing and repayment history with the company, outstanding balance, instalments.

3.4 KYC data: live face capture taken in the app (liveness) and an image of the ID card taken with the in-app camera at that moment.

3.5 Device data needed to provide the service: device model, operating system, app version, notification token, IP address, security logs.

3.6 Support data: the content of messages sent to cs@.

4. Data we do not collect and permissions the app will never request

Prohibited and never requested: phone book / contacts (READ_CONTACTS), photo or video gallery (READ_MEDIA_IMAGES / READ_MEDIA_VIDEO), external storage (READ/WRITE_EXTERNAL_STORAGE), precise location (ACCESS_FINE_LOCATION), SIM phone number (READ_PHONE_NUMBERS), list of all installed apps (QUERY_ALL_PACKAGES), SMS messages, call logs, and continuous microphone access unrelated to the service.

Identity verification uses only the live in-app camera; the photo album is never opened.

5. Purposes and legal bases (section 24; consent under section 19)

5.1 Entering into the contract and providing credit — contract / pre-contractual steps. Without this data the company cannot assess or grant a loan.

5.2 Identity verification and prevention of impersonation and fraud — legitimate interests and contract. Face/ID data is sensitive or limited biometric data; additional explicit consent under section 26 is obtained where required by law.

5.3 Account administration, payment requests, receipts and lawful collection — contract and legal obligation (Debt Collection Act).

5.4 Accounting and financial record-keeping — legal obligation.

5.5 System security and prevention of computer crime — legitimate interests.

5.6 Customer service and complaints — contract / legitimate interests.

5.7 Marketing (email / promotional notifications) — consent only, withdrawable at any time without affecting the core service.

5.8 Compliance with court orders or competent authorities — legal obligation.

6. Sources

Directly from the data subject, from the device when using the app, and from payment processors (e.g. the receiving bank). The company does not obtain data from the National Credit Bureau while this policy is in effect; if it does so in future, a new policy will be issued and lawful consent obtained first.

7. Recipients

The company does not sell personal data.

• Employees and directors on a need-to-know basis.
• Data processors (cloud hosting in Thailand or in countries with adequate safeguards, KYC liveness providers, transactional email/SMS providers, payment providers) under contracts compliant with section 40.
• Legal advisers and auditors.
• Assignees of claims under the loan agreement (if any), who must protect data to a standard no lower than this policy.
• Government authorities, courts and officials under warrant or law.

8. Cross-border transfers

Core systems are intended to process data in Thailand. If a transfer abroad is required, standard contractual clauses or consent under the cross-border transfer provisions will be used, and the category of destination country will be disclosed on this page when it actually occurs.

9. Retention

At the end of the period the company deletes or anonymises the data.

• Website visitor data / non-essential cookies: per the cookie policy, or until consent is withdrawn.
• Applications not approved: no more than 24 months.
• Customer and contract data: the life of the contract plus 5 years, or longer where accounting, tax or limitation-period law requires.
• Security logs: no more than 12 months, unless needed as evidence in a case.

10. Your rights

Submit requests to dpo@prosperanexus.com or to the head office address. The company will respond within 30 days unless the law permits an extension.

• Withdraw consent (section 19).
• Access and obtain a copy (section 30).
• Rectification (section 31).
• Erasure or destruction where the law allows (section 33).
• Restriction of processing (section 34).
• Object to collection, use or disclosure (section 32).
• Receive data in a machine-readable format and have it transmitted to another controller where the law supports it (section 31 transfer provisions / data portability under PDPC guidance).
• Complain to the Personal Data Protection Committee (section 73).

11. Security

Encryption in transit (HTTPS/TLS), restricted access rights, access logging, and staff confidentiality obligations. In the event of a breach posing a high risk to rights, the company will notify the PDPC and data subjects as required by law without undue delay (72-hour guideline where the threshold is met).

12. Children and minors

The credit service is for persons aged 20 or over. We do not knowingly collect data of persons under 20; if found, it will be deleted unless retention is needed to evidence the refusal of service.

13. Cookies

See https://www.prosperanexus.com/cookies. Non-essential cookies are used only with consent.

14. Changes to this policy

New versions are published on the website with a version number. Material changes of purpose will be notified in advance, and consent obtained where the law requires.

15. Contact for personal data matters

dpo@prosperanexus.com / cs@prosperanexus.com / 093-737-3482