Privacy Notice for Employees

This Privacy Notice covers the personal data of job applicants and Company personnel, such as consultants, executives, officers, current employees, former employees, interns, and any persons related to Company personnel, such as family members and emergency contacts.

The Company collects personal data and/or sensitive data through the following processes:

The Company may collect the following types of personal data, such as:

• General Data

  Name, surname, national ID number, date of birth, address, phone number, email, photograph

• Education & Work History

  Special skills, training history, certificates

• Family & Emergency Contacts

  Emergency contact persons

• Bank Account Data

  Bank account information for salary and compensation payments

• IT System Data

  e.g. Email usage logs, document management system, server access logs

• Sensitive Data (if necessary and with consent)

  e.g. Criminal records or health information

The Company collects, uses, or discloses your personal data under the following legal bases:

• Contract
• Legal Obligation
• Legitimate Interest
• Vital Interest
• Consent — The Company will request your consent where required by law, or where none of the above legal bases are applicable to the personal data collected from you.

The purposes for collecting, using, and disclosing employees' personal data include, for example:

• Screening, selection, and interviewing of job applicants
• Human resource management including employment contracts, performance evaluations, training, salary payments, other benefits, and maintaining entitlements
• Considering suitable future positions
• Complying with labor law, tax law, social security law, and other applicable laws
• Managing welfare, health insurance, accident insurance, or life insurance
• Preparing reports for submission to relevant government agencies
• Controlling building access, CCTV recording, and security measures
• Managing, developing, and improving business operations efficiency
• Managing complaints, disputes, litigation, and risk management
• Conducting internal organizational activities such as parties, training, CSR activities
• Complying with orders from legally authorized agencies

8.1 The Company will retain your personal data for as long as necessary, taking into account the necessity and purposes for which it was collected, used, and processed, including compliance with applicable legal requirements, such as:

• Applicants not selected: Data retained for 6 months from the date of notification, so the Company can contact you for potentially suitable future positions.
• Company employees: Data retained for no more than 10 years from the date of termination of employment, for the purpose of verification and dispute resolution within the legally prescribed limitation period.

8.2 The Company will review and delete, destroy, or permanently anonymize personal data upon expiry of the retention period, when data is no longer relevant or necessary for the purposes of collection, or when the Company must comply with your valid deletion request.

The Company implements measures in accordance with Section 37 of the PDPA and ISO/IEC 27701 standards, including appropriate technical, physical, and organizational security measures to prevent unauthorized loss, access, use, alteration, modification, or disclosure of personal data, including:

• Access control with authentication and authorization systems
• Data encryption for stored and transmitted data
• Logging and monitoring of data-related activities
• Data backup and disaster recovery (DR & BCP)
• PDPA and ISO/IEC 27701 training for employees and stakeholders
• Regular review, testing, and assessment of security measures
• Requiring data recipients to maintain confidentiality and process data only as specified by the Company

Data subjects have the following rights regarding their personal data:

Additional Note: The exercise of the above rights may be limited by law, such as when the Company has legal obligations or court orders, or when exercising the right would violate others' rights. If a request must be denied, the Company will clearly explain the reasons.

The Company's applications or website may contain links to third-party social networks, platforms, and websites. While the Company strives to link only to sites with adequate personal data protection standards, it cannot be responsible for the content or data protection standards of other sites. Personal data you provide to third-party websites is collected by those parties and governed by their own privacy policies. We recommend reviewing their policies separately.

If you have questions or wish to exercise your rights, please contact:

This Privacy Notice is governed by and interpreted in accordance with Thai law. Thai courts shall have jurisdiction over any dispute that may arise.

The Company regularly reviews this Privacy Notice to ensure consistency with practices and applicable laws. Any significant changes will be communicated through appropriate channels along with the updated version. We recommend checking this notice periodically.