Privacy Policy
Outlier Co., Ltd. (hereinafter referred to as the “Company”) recognizes the importance of personal data and other information relating to you (collectively referred to as “Data”). To ensure that you can have confidence that the Company is transparent and responsible in collecting, using, or disclosing your Data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (the “Personal Data Protection Law”), including other relevant laws, this Privacy Policy (the “Policy”) has been prepared to inform you of the details regarding the collection, use, or disclosure (collectively referred to as “Processing”) of personal data carried out by the Company, as follows:
This Policy applies to the personal data of persons who currently have, or may in the future have, a relationship with the Company, and whose personal data is processed by the Company. This also includes contractual parties or third parties who process personal data on behalf of or in the name of the Company (“Personal Data Processors”) under the Good Life Tracker application system service (collectively referred to as the “Service”).
Persons having a relationship with the Company under the first paragraph include visitors and users of the Good Life Tracker application system (referred to as “you”).
In addition to this Policy, the Company may issue privacy notices (“Notices”) for the Company’s services to inform personal data subjects who are service users of the personal data being processed, the purposes and lawful bases for processing, the personal data retention period, and the rights of personal data subjects in relation to each specific service.
In the event of any material conflict between a privacy notice and this Policy, the privacy notice for that specific service shall prevail.
(a) Company means Outlier Co., Ltd.
(b) Personal Data means any information relating to a natural person that enables the identification of such person, whether directly or indirectly, but does not include information of deceased persons in particular.
(c) Sensitive Personal Data means personal data as prescribed under Section 26 of the Personal Data Protection Act B.E. 2562 (2019), including race, ethnicity, political opinions, beliefs in a cult, religion or philosophy, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data which similarly affects the personal data subject as prescribed by the Personal Data Protection Committee.
(d) Processing of Personal Data means any operation performed on personal data, such as collection, recording, copying, organization, storage, retention, modification, alteration, use, retrieval, disclosure, transfer, dissemination, transmission, combination, deletion, destruction, etc.
(e) Personal Data Subject means a natural person who owns the personal data collected, used, or disclosed by the Company.
(f) Data Controller means a person or juristic person who has the authority and duty to make decisions regarding the collection, use, or disclosure of personal data.
(g) Data Processor means a person or juristic person who carries out the collection, use, or disclosure of personal data according to the instructions or on behalf of the Data Controller, provided that such person or juristic person is not the Data Controller.
The Company collects or obtains various types of personal data from the following sources:
3.1) Personal data collected by the Company directly from the personal data subject through various service channels, such as during registration, service sign-up, or when the personal data subject communicates with the Company at the Company’s office or through other contact channels controlled by the Company, etc.
3.2) Data collected by the Company from the personal data subject’s use of the application, such as tracking application or service usage behavior through the use of cookies or from software on the personal data subject’s device, etc.
The Company may collect, use, process, or disclose your personal data as necessary and for the purposes of providing the Good Life Tracker service, including participation in activities, campaigns, benefits, or other related services. The types of personal data that the Company may collect, use, or disclose are as follows:
4.1) Personal identification data, which means information that identifies you, such as title, first name, last name, middle name, nickname, etc.
4.2) Personal attribute data, which means information relating to your personal characteristics, such as date of birth, gender, age, etc.
4.3) Contact information, which means information used to contact you, such as mobile phone number, LINE ID, email address, etc.
4.4) Data relating to the Company’s services, which means details relating to the Company’s services, such as username, password, PIN, Single Sign-on information (SSO ID), OTP code, computer traffic data, location data, usage behavior data, search history, cookies or similar technologies, device number (Device ID), device type, connection details, browser information, language used, operating system used, etc.
4.5) Sensitive personal data, which means step count data obtained from Apple Health, Health Connect, or other data sources that you connect with the Good Life Tracker service. The Company accesses and collects only step count data from such connected health or fitness data sources and does not access or collect other health or fitness data from those sources. Sensitive personal data will be collected only when the Company has obtained your explicit consent.
Where you participate in activities or campaigns relating to Nestlé, the Company may disclose or transfer only the relevant step count data to Nestlé (Thai) Ltd., companies within the Nestlé group, and/or persons assigned by such companies, as necessary for verifying eligibility, calculating points, providing benefits or rewards, preparing reports, and analyzing activity participation results.
In the event that the data disclosed or transferred by the Company to such persons is sensitive personal data, such as step count data, the Company will proceed within the scope of the explicit consent that you have provided.
Providing your personal data to the Company is voluntary. However, if you do not provide personal data or do not give consent for the collection, use, or disclosure of certain types of data, especially data necessary for the provision of the service or participation in activities, you may not be able to use the Good Life Tracker service, participate in activities, receive points, receive benefits, or redeem rewards, whether in whole or in part.
If the Company becomes aware that personal data which requires consent for collection belongs to a personal data subject who is a minor, incompetent person, or quasi-incompetent person, the Company will not collect such personal data until consent has been obtained from the person exercising parental power who has authority to act on behalf of the minor, or from the curator or guardian, as the case may be, in accordance with the conditions prescribed by law.
If the Company did not previously know that the personal data subject is a minor, incompetent person, or quasi-incompetent person, and later discovers that the Company has collected the data of such personal data subject without obtaining consent from the person exercising parental power who has authority to act on behalf of the minor, or from the curator or guardian, as the case may be, the Company will delete or destroy such personal data as soon as possible, unless the Company has another lawful basis other than consent for collecting, using, or disclosing such data.
The Company collects, uses, and processes your personal data for various purposes. The purposes stated below are only a general framework for the Company’s use of personal data. Only the purposes relevant to the service you use or the relationship you have with the Company shall apply to your data.
6.1) To perform the Company’s duties and responsibilities and to achieve the purposes of providing the Good Life Tracker service, particularly the tracking of daily walking activities.
6.2) To supervise, provide, monitor, verify, and manage the service in order to facilitate usage and provide services that meet your needs.
6.3) To retain, update, and manage data relating to you or your use of the service.
6.4) To prepare records of personal data processing activities as required by law.
6.5) To analyze data, resolve problems, verify accuracy, and improve the efficiency of the service.
6.6) To identify, authenticate, and verify information when you register for the service, contact the Company for services, or exercise legal rights.
6.7) To improve and develop the quality of the Good Life Tracker application so that it is appropriate, secure, and up to date.
6.8) To send notifications, confirmations of actions, communications, and information related to the service to you.
6.9) To identify, prevent, investigate, or suspend spam, unauthorized actions, or unlawful acts.
6.10) For any other purposes that the Company agrees with you from time to time or that the law permits the Company to carry out.
6.11) For public relations and to invite you to participate in relevant special activities, only where you have given consent or where the law permits the Company to proceed.
6.12) To manage activities or campaigns related to the Good Life Tracker service, verify eligibility, calculate points, provide benefits or rewards, prepare reports, analyze activity participation results, and communicate with you in relation to the activities or services in which you participate, including disclosing or transferring the relevant step count data to Nestlé (Thai) Ltd., companies within the Nestlé group, and/or persons assigned by such companies, only as necessary to carry out such purposes.
Under the purposes stated in Section 6 above, the Company may disclose your personal data to the following persons. The categories of data recipients stated below are only a general framework for the Company’s disclosure of personal data. Only data recipients relevant to the service you use or the relationship you have with the Company shall apply.
7.1) Persons within the Company, whereby the Company will disclose data only as necessary for the benefit of internal organizational management.
7.2) Government authorities or competent authorities to whom the Company is required to disclose data for the purpose of compliance with law or other important purposes, such as law enforcement agencies or regulatory authorities, or for other important purposes, such as the Cabinet, responsible ministers, Department of Provincial Administration, Revenue Department, Royal Thai Police, courts, Office of the Attorney General, Department of Disease Control, Ministry of Digital Economy and Society, National Health Security Office, etc.
7.3) Technical advisors and experts.
7.4) Service providers, contractors under agreements, or agents acting on behalf of the Company.
7.5) Nestlé (Thai) Ltd., companies within the Nestlé group, and/or persons assigned by such companies, to whom the Company may disclose only the relevant step count data where you participate in a Nestlé-related activity or campaign, as necessary for eligibility verification, point calculation, the provision of benefits or rewards, report preparation, and analysis of activity participation results.
In the event that the data disclosed or transferred to such persons is sensitive personal data, such as step count data, the Company will proceed only within the scope of the explicit consent that you have provided.
In some cases, the Company may need to transfer your personal data overseas in order to carry out the purposes of providing services to you, such as transferring personal data to a cloud system where the platform or servers are located overseas, for example in Singapore or the United States, to support information technology systems that must be located outside Thailand. This depends on the Company’s service that you use or are involved with on an activity-by-activity basis.
However, at the time this Policy is prepared, the Personal Data Protection Committee has not yet issued a notification specifying the list of destination countries with adequate personal data protection standards. Therefore, when the Company is required to transfer your personal data to a destination country, the Company will take steps to ensure that the personal data transferred has sufficient personal data protection measures in accordance with international standards, or will comply with the conditions under which such data may be transferred in accordance with law, including:
(a) The transfer is required for compliance with law that requires the Company to transfer personal data overseas.
(b) You have been informed and your consent has been obtained in the event that the destination country has inadequate personal data protection standards, in accordance with the list of countries announced by the Personal Data Protection Committee.
(c) The transfer is necessary for carrying out activities for important public interest.
The Company will retain your personal data for a period of 1 year. Upon expiry of the applicable retention period, the Company will delete, destroy, or anonymize the personal data within a reasonable period in accordance with applicable law and the Company’s data retention and deletion procedures. If you delete your user account with the Company before the expiry of the 1 year period above, the Company will continue to retain your personal data for the remainder of such 1 year period.
However, in the event of any dispute, exercise of rights, or litigation relating to your personal data, the Company reserves the right to continue retaining such data until the dispute has been finally ordered or adjudicated.
The Company will maintain the security of your personal data in accordance with the principles of confidentiality, integrity, and availability, by using appropriate technical and security standards to protect your personal data collected through the application from unauthorized access, misuse, loss, destruction, or improper use.
In addition, the Company will provide personal data security measures covering administrative safeguards, technical safeguards, and physical safeguards in relation to access to or control of the use of personal data (access control).
The Personal Data Protection Act B.E. 2562 (2019) provides personal data subjects with various rights. Such rights shall take effect when the provisions of law relating to such rights become effective. The details of the rights are as follows:
You have the right to request access to, obtain a copy of, and request disclosure of the source of personal data collected by the Company without your consent, except where the Company has the right to reject your request on legal grounds or by court order, or where the exercise of your right may adversely affect the rights and freedoms of other persons.
If you find that your personal data is inaccurate, incomplete, or not up to date, you have the right to request rectification so that it is accurate, up to date, complete, and not misleading.
You have the right to request the Company to delete or destroy your personal data, or to anonymize your personal data so that it can no longer identify you, if you consider that your personal data has been collected, used, or disclosed unlawfully under the relevant law, or that the Company no longer has the necessity to retain it for the purposes related to this Policy. The exercise of the right to deletion or destruction of personal data shall be subject to the conditions prescribed by law.
You have the right to request the restriction of use of your personal data when you contest the accuracy or completeness of the personal data collected by the Company.
You have the right to object to the collection, use, or disclosure of personal data relating to you.
Where you have given consent to the Company for the collection, use, or disclosure of personal data, whether such consent was given before or after the Personal Data Protection Act B.E. 2562 (2019) came into effect, you have the right to withdraw your consent at any time throughout the period during which your personal data is retained by the Company, unless there is a legal restriction requiring the Company to continue retaining the data or there remains a contract between you and the Company that benefits you.
You have the right to receive your personal data from the Company in a format that is readable or generally usable by tools or devices operating automatically, and that can be used or disclosed by automated means. You may also request the Company to transmit or transfer such data in that format directly to another Data Controller, unless this cannot be done due to technical reasons. The exercise of this right shall be subject to the conditions prescribed by law.
You may exercise your rights as a personal data subject above by contacting the Company’s Personal Data Protection Officer using the details at the end of this Policy. The Company will inform you of the result of the action taken within 30 days from the date the Company receives your rights request, in accordance with the form or method prescribed by the Company. If the Company rejects your request, the Company will inform you of the reason for the rejection through various channels, such as SMS, email, telephone, letter, etc.
The Company may consider updating, amending, or changing this Policy as it deems appropriate, and will notify you through the Good Life Tracker application channel. Each amended version will specify its effective date.
Your use of the Company’s service after the new Policy becomes effective shall be deemed as your acknowledgment of the terms of the new Policy. If you do not agree with the details of this Policy, please stop using the service.
This Policy applies only to the Company’s services. If you connect to other applications, even through the application channel, you must separately review and comply with the personal data protection policies appearing in those applications, separate from the Company’s Policy.
If you have any questions, suggestions, or concerns regarding the Company’s collection, use, or disclosure of personal data, or regarding this Policy, or if you wish to exercise your rights under the Personal Data Protection Law, you may contact the Company at:
Outlier Co., Ltd.This Policy is effective as of 19 June 2026