LINE MyCustomer - Guidelines
Enacted: August 17, 2023
1. IntroductionThe LINE MyCustomer Guidelines (hereinafter "the Guidelines") are intended to explain details of different features available on LINE MyCustomer which anyone who uses LINE MyCustomer services (hereinafter "Brands", "you", or "your") should be aware of when using LINE MyCustomer services (hereinafter "Services") offered by LINE Company (Thailand) Limited (hereinafter "LINE", "we", or "us"). These Guidelines apply, together with the LINE MyCustomer Terms of Use (hereinafter referred to as the "Terms of Use"). In case of conflict between the Guidelines and the Terms of Use, the Guidelines will take priority.
These Guidelines shall provide recommendations for Brands, but do not constitute as a legal advice. The compliance with the Guidelines does not guarantee that you will be compliant with applicable laws. You may want to consult with your legal advisor to ensure you compliance with applicable laws.
These Guidelines apply to all Brands, their administrators, and any persons accessing LINE MyCustomer account to use LINE MyCustomer Services. Brands are responsible for ensuring that their administrators and any persons accessing LINE MyCustomer account are aware of the Guidelines and appropriately comply with the Guidelines when conducting activities on LINE MyCustomer
The Guidelines are current as of the last revised date set out below. We may change the Guidelines from time to time. We encourage you to review the Guidelines periodically.
According to the Terms of Use, Brands are responsible for complying with all applicable laws and agree not to take any action in connection with the use of the Services in violation of any applicable laws. In connection with the use of Services, the applicable laws may include personal data protection laws, content laws, and intellectual property laws, among other things.
In general, personal data protection laws prescribe requirements with respect to the handling of personal data. For example, under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), personal data is defined as any information that relates to a natural person and enables the identification of that person, whether directly or indirectly, but not including information of deceased persons. In relation to the Services, some examples of personal data are as follows:
Examples of Personal Data
(1) Names, e.g., first name, last name, nickname, and profile name;Examples of Non-personal Data
(1) Company's registration number;Nonetheless, personal data protection laws also provide special protection of certain categories of personal data or what is referred to as "sensitive personal data". Under the PDPA, sensitive personal data are personal data pertaining to racial, ethnic, origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, labor union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the supervisory authority, namely the Personal Data Protection Committee (the "PDPC"). According to the Terms of Use, the collection of sensitive personal data by using survey feature is prohibited.
With respect to the roles of Brands under the personal data protection laws, each Brand would be considered as a data controller since each Brand has the power and duties to make decisions regarding the collection, use, or disclosure of personal data when using the Services. LINE would be considered as a data processor who acts under instructions or on behalf of Brands in relation to the collection, use, and disclosure of personal data.
In this regard, Brands would have obligations to comply with the PDPA when collecting, using, and disclosing personal data. These include the obligations to obtain consent from the data subject (if no other legal basis can be relied on), to provide required details to data subjects (e.g., via Brand's Privacy Policy) before or at the time of the collection of their personal data, to handle the personal data in accordance with the informed purpose, to delete or destroy personal data after the end of the retention period or when it is no longer necessary, and to comply with the data subject's rights, among other things.
LINE has prepared some features in LINE MyCustomer to facilitate the Brand's compliance with some obligations under the PDPA. Please see 4. Acknowledgment of the Brand's Privacy Policy and Acceptance to Terms and Conditions in Survey Plugin and 5. Opt-in and Opt-out Feature for more details.
3.2 Content LawsThe Computer-related Crime Act B.E. 2550 (2007) as amended ("CCA") penalizes certain activities involving computer data or computer system. This includes prohibition of certain contents available online. The CCA prohibits the content that has the following characteristics:
1) dishonestly or by deceit, entering the computer data which is distorted or fake, whether in whole or in part, or false computer data, in a manner that is likely to cause damages to the public, and where it is not a defamation offense under the Penal Code (e.g., online scam);Brands must ensure that the content created or disseminated does not contain illegal contents under the CCA.
LINE as a service provider has no specific obligation towards Brands to monitor or review any information submitted to the Services whether it violates any applicable laws. We also do not take part, collaborate in, give consent to, or connive with Brands in the creation or dissemination of any illegal contents.
Nonetheless, we allow any person to request to take down the illegal content under the CCA and its subordinate regulation. For example, LINE users would be able to report your content (e.g., survey which may contain illegal content asked by Brands). Upon receiving all required information and document as required by law, we would have to take down such content. You can learn more about how LINE users can request for take-down of illegal content under the CCA here.
3.3 Intellectual Property LawsLINE is committed to ensuring that Contents (as defined below) available in connection to the Services do not infringe any intellectual property rights. According to Article 9 of the Terms of Use, Content (meaning information or content in a form that Brands allow to be transmitted to or accessible by LINE users through use of the Services, including, but not limited to, account icons, profile information, texts, images, and videos dispatched by customers) distributed by Brands must not infringe the rights of third parties (including, but not limited to, copyrights, moral rights, patent rights, trademark rights, design rights, utility model rights, trade secrets, honor rights, rights of portrait, rights of privacy, and rights of publicity).
We do not take part in the infringement of intellectual property rights, especially with respect to copyright as provided by law. We allow any person to report copyright infringement and take down such infringing content when legal criteria are met. The requester must ensure that the request has taken into account the copyright exemptions. Therefore, upon receiving all required information and document, we would have to take down such content. You can learn more about how LINE users can request for take-down of illegal content under the Copyright Act here here. Without prejudice to the LINE's right to terminate the Services under the Terms of Use and by law, in case that the Brands repeatedly violate other intellectual property rights with respect to Contents, LINE may terminate Brands’ use of the Services without prior notice to the Brands.
Survey is one of the plugins integrated into LINE MyCustomer Services that allows Brand to create and design personalized surveys. Brands are able to create survey questions in free form and customize various field types in the survey i.e., question types, survey conditions, etc., and then send it to Brand's customers (i.e., LINE users). The survey can be shared through a link or QR code generated by the survey plugin.
4.1. Brand’s Terms and ConditionsIn some instances, terms and conditions may be called "Terms of Use", "User Agreement", "Terms of Services", etc. Nevertheless, they refer to a legal document setting out the agreement between LINE users and Brands. In essence, terms and conditions outline the scope of the relationship between the parties, i.e., Brands and LINE users, conditions for the provision of goods or services, their obligations towards each other, the scope of responsibilities and liabilities between them, privacy, intellectual property rights, liabilities, disclaimers of warranties, termination of the service, and other contractual terms that may be relevant, among other things. Generally, these terms and conditions are standard contract form that the other party (i.e., LINE users who have added the LINE Official Account to their friend lists ("LINE Official Account Friends")) must agree to in order to access and use the Brand's products or services. Therefore, the terms and conditions should be fair and transparent to your LINE Official Account Friends.
For the survey feature, we encourage you to input your terms and conditions to have your customers (i.e., your LINE Official Account Friends) agree to them. The content of the terms and conditions may vary depending on your business, legal obligations, and risk management, among other things. This could be your existing terms and conditions that could be applicable to this survey feature, or a separate terms and conditions specifically made for this survey.
4.2. Brand’s Privacy PolicyWhere there is a collection, use, and disclosure of personal data, you will be obliged to provide your LINE Official Account Friends with all required details about their privacy as prescribed by personal data protection laws. The required details prescribed by personal data protection laws are generally provided in a legal document called privacy policy, privacy notice, privacy statement, or other similar names (“Privacy Policy”). Specifically, under the PDPA, Brands as data controllers are required to notify the data subject of the following details before or during the collection of their personal data:
(1) the purposes of processing personal data, including the purposes that based on a legal basis which the personal data can be processed without consent from the data subject;
In this regards, it is each Brand's legal obligations as a data controller to notify participants of the survey of the aforementioned details for collecting, using, and/or disclosing the personal data obtained through the survey features or via other means as the Brand deems appropriate. We encourage you to prepare a legal compliant Privacy Policy to be notified to the data subjects, which are LINE Official Account Friends, prior to or at the time you collect their personal data. This can be your existing Privacy Policy or new Privacy Policy which only applies to the survey. In any case, you should ensure that the Privacy Policy covers the processing activities of personal data in relation to the survey.
4.3 Channels for Obtaining Acceptance and AcknowledgmentLINE MyCustomer allows Brands to be able to provide their terms and conditions and Privacy Policy to its customers by adding such documents to the survey. During the creation of the survey, on the "Create Survey" page, there are two ways to add terms and conditions and a Privacy Policy to the survey:
(i) Insert links to your Privacy Policy and terms and conditions of your website or third-party website where Privacy Policy and term and conditions are available. On the survey page, the provided link will be shown where users can access the link to the destination website; orFurthermore, you are able to designate when the terms and conditions and Privacy Policy will appear in the survey. You can choose between the following placement options:
(i) Before survey - placing the terms and conditions and the Privacy Policy before the participants can see or start the survey. Participants of the survey will be required to accept the terms and condition and acknowledge the Privacy Policy prior to starting the survey.Opt in/out Management is the feature that allows the LINE users who have added the LINE Official Account to their friend lists ("LINE Official Account Friends") to change their preferences to opt in or opt out with respect to the collection, use, and disclosure of their personal data by Brands. The Opt in/out Management feature covers the cases where (1) Brands are required to obtain opt-in consent from LINE Official Account Friends; or (2) Brands are required to provide options for their LINE Official Account Friends to opt out or object to the processing of their personal data. Please see our examples below to help you understand when to use Opt in/out Management feature.
Example 1: Opt-out
Brand A intends to collect data of LINE Official Account Friends via the Survey feature and use that data to (1) analyze the interests of the LINE Official Account Friends to develop the Brand's own products and (2) send marketing messages of Brand A's products that relate to the products that LINE Official Account Friends have purchased and may be in the interests of those LINE Official Account Friends via SMS and email. Brand A already considered and consulted with Brand A's legal advisor that these purposes are the processing that do not require consent from their LINE Official Account Friends because Brand A can rely on legitimate interest basis under the PDPA.
Brand A may create 2 opt-out fields via Opt in/out Management feature that allow the LINE Official Account Friends to choose whether to opt-out/object for the use of their personal data for data analytics and marketing communications. As it is an opt-out, the toggle is on as a default as the law allows Brand A to process personal data without opt-in consent. However, the LINE Official Account Friends would be allowed to toggle off to opt-out/object to the processing at any time as the law allows so.
Example 2: Opt-in
Brand B intends to collect personal data of LINE Official Account Friends via the Survey feature and use that personal data to (1) analyze the interests of the LINE Official Account Friends to develop the Brand's products as well as to share data of LINE Official Account Friends to other brands' products for the other brands' development of other brands' products; and (2) send marketing messages of Brand B's product and other brands' products that are not relevant to the products that LINE Official Account Friends has purchased via SMS and email. Brand B already considered and consulted with Brand B's legal advisor that these purposes are the processing that require consent from their LINE Official Account Friends because Brand B cannot rely on other legal basis under the PDPA as an exception to consent.
Brand B may create 2 opt-in fields via Opt in/out Management feature that allow the LINE Official Account Friends to choose whether to opt-in/provide consent for the use of their personal data for purposes that require their consent. As opt-in consent is required, the toggle must be off at the beginning. The LINE Official Account Friends must choose to provide their opt-in consent by toggling on by themselves.
It is your responsibility as a data controller to consult your legal advisor first whether which processing activities require consent or not before using this Opt in/out Management feature.
This way, the Opt in/out Management feature will help Brands to set the fields for LINE Official Account Friends to choose their preferences, whether an opt-in consent is required or not, and enable Brands to filter in/out (segment) such LINE Official Account friends in the Audience plugin for further use.
Being data controllers, Brands are responsible to keep track of the opt-in or opt-out data selected by LINE Official Account Friends. Therefore, Brands must always keep opt-in or opt-out data up-to-date.
Please note that opt-in or opt-out data from Opt in/out Management feature will only show opt-in and opt-out made via the Opt in/out Management feature. If a LINE Official Account Friend opt-out via other methods (e.g., chat with Brands or call Brand's customer service), opt-in or opt-out data from those other method will not be included in this feature. Brands must monitor and manage your chat and call functions separately to comply with the law.
'Preferences setting', where your LINE Official Account Friends can change their preferences, will not appear anywhere in the LINE Application settings or in the chat plugin. Therefore, in order for the LINE Official Account Friends to access this page, we recommend Brands add it to the Rich Menu which can be accessed when the LINE Official Account Friends uses the chat feature with Brands in order to make the preferences setting to be visible to your LINE Official Account Friends.
LINE MyCustomer will periodically notify you when LINE Official Account Friends make changes to their opt-in and opt-out preferences with a in-app notification. However, the notification made to you is not synced in real-time. As such, as a data controller, you must monitor and ensure that your opt-in and opt-out data are up-to-date before processing personal information.
The same goes for the export feature, LINE MyCustomer also allows Brands to export opt-in and opt-out data to CSV file format. However, opt-out data may not be most updated as it may take up to 24 hours for opt-out data to be updated into the system. You, as a data controller, are solely responsible to make sure that opt-in and opt-out data you will use is most up-to-date.
Please note that LINE only facilitates your opt-in and opt-out management. You are considered a data controller and LINE only acts under your instructions in relation to the collection, use, and disclosure of personal data. You are responsible for your compliance or non-compliance with your legal obligations.
When changing the opt-in and opt-out form (e.g., changing the wording, adding or removing the opt-in/opt-out message), the system will notify you with the following message: "You have updated the existing messages which might affect the existing responses. Do you want to reset the responses or keep the records of responses? Once you reset the responses, records of previous responses will be deleted, and this cannot be undone."
(i) If you choose 'Keep' - all records of the existing responses will be kept in the system and still be accessible until you decide to delete them later.This feature will help the Brand keep track of the consent from the data subjects as well as the exercise of the right to withdraw consent and the right to object to the collection, use, and disclosure of data subject's personal data, in order to facilitate the Brand to comply with the PDPA in practice, but this is only a facilitation. The Brand must monitor and keep track as a data controller per the law requires.
(ii) If you choose 'Reset' - all records of previous responses will be deleted, and such records will be inaccessible indefinitely. This cannot be undone. LINE MyCustomer will then start recording the new response for the updated opt-in/opt-out messages.LINE MyCustomer offers Retention Management, a feature that allows Brands to manage the retention period of the data collected and stored on LINE MyCustomer for different features. Brands are able to set the retention period for the data of each feature (e.g., data from Audience feature, Link tracking feature, Survey feature, User preference data, Personal Data, Facebook data, etc.) for the convenience of Brands in managing their storage of data when using the Services.
Please note that this Retention Management feature is not intended for Brands to use for compliance with their relevant legal obligations. Brands are still responsible to comply with their own legal obligations with respect to data retention, including data protection laws, in relation to retention of data. Therefore, in addition to this feature, Brands must have your own data retention system and procedure to comply with the law, including the CCA.
Brands have the following data retention period options for selection under this feature:
- 90 days (Note that this is the minimum retention period with reference to the storage of computer traffic data under the CCA).The beginning of retention period for each feature as selected by the Brand varies depending on the nature of that feature. For example, the beginning of the retention period for survey feature will begin counting from the publication date of the survey. On the other hand, for link tracking and groups, the retention period will begin counting based on the most recent interaction of the LINE user.
After such a period set by the Brand ends, data will be deleted indefinitely and the Brand will no longer be able to access such data.
Any changes to the retention period of options do not apply retroactively and do not affect the retention of data previously selected. You should take caution when selecting the retention period to ensure that retention periods are consistent for the data you would like to retain. We encourage you to consult this with your legal advisor first before choosing the appropriate retention period. In the case where the Services are terminated (including where the Brand cancels the subscription of LINE MyCustomer), Brands are responsible to manage data stored on LINE MyCustomer prior to the termination. LINE would not be obliged to provide any data stored on the LINE MyCustomer once the Services are terminated.
The data retained by LCT would be deleted after the termination of the services. However, Brands may request for the data to be retrieved upon renewal of service within 90 days from the date of the suspension of use or termination.
Date of enactment: August 17, 2023