Employee Privacy Notice

This Employee Privacy Notice (hereinafter referred to “Privacy Notice”) has set out in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (hereinafter referred to “PDPA”) and has been created by Sojitz (Thailand) Co., Ltd. (hereinafter referred to “Company”, “we” or “us”). The Company is aware of its obligations under the PDPA and is committed to collecting, using, disclosing (hereinafter referred to “process, processing, processed”) your personal data securely and transparently. Therefore, we urge to read this Privacy Notice carefully, as we take our Privacy Notice very seriously.

1. Application to this Privacy Notice

This Privacy Notice applies to the Company’s current and former employees, workers and contractors (hereinafter referred to “you”).

By submitting your personal data to us, you acknowledge that:

1. You have read and understood this Privacy Notice and agree to the processing of your personal data as set out herein.
2. You are not required to provide any requested personal data to us but failing to do so may prevent or delay the fulfillment of our obligations under the law or the agreement.
3. Your personal data may be transferred and processed outside Thailand, including countries that may not be deemed to provide the same level of data protection as Thailand, for the purpose and in the manner specified in this Privacy Notice.
4. All of your representations are true and correct to the best of your knowledge and belief, and you have not knowing omitted any related information of an adverse nature. Providing any inaccurate information may take you ineligible for employment.
5. This Privacy Notice shall not form part of any agreement of employment or other contract to provide services.

2. Types of personal data we collect

We hold many types of data about you, including:

Personal basic data:

1. Personal contact details such as name, title, addresses, telephone number, and personal email addresses
2. Date of birth 1
3. Gender
4. Emergency contact information
5. Marital status
6. Relation and dependents information, especially contact information
7. Identity card information
8. Identity card’s copy
9. Driving licence information
10. Driving licence’s copy
11. Passport information
12. Passport’s copy
13. Bank account details
14. Nationality
15. Photo

Data related to employment relationship:

1. Work contact details
2. A copy of your ID card, passport or similar photographic identification and proof of address documents.
3. Next of kin, emergency contacts and their contact information.
4. Type of contract, contract details, employment ID number.
5. Title, position description, working history and records, working location, years of services.
6. Salary, benefits, tax and pension-related information and historical records.
7. Performance-related data, such as your objectives, performance discussions and assessment records, feedback and tests results.
8. Qualifications and personal development related data, such as records of development discussions and competence assessments, learning and development records, certificates, licenses and vocational records, records of career and succession planning.
9. Information about working hours, vacation and absences.
10. Recruitment history – cv details, previous work experiences and educational background, information of general interests, membership to associations, any information you have provided us during the interviews, information gathered from reference persons whose contact details you have provided to us.
11. Documentation relating to your right to work in Thailand.
12. Training details.
13. Leave records including annual leave, personal leave, sickness absence etc and your reason for leaving.
14. Letters of concern, formal warnings and other documentation with regard to any disciplinary proceedings.
15. Information related to immigration, right-to-work and residence status.
16. Travelling and travel expenses related data as well as user account details.
17. Information relating to misconducts and disciplinary actions, background check reports and security data.
18. Data related to incident reporting, including time and place of accident and “near misses” at work, description of the respective incident including information relating to the persons involved in such incidents and the effects the incidence has had on these persons (including also limited health related data), consequences of the incident including data relating to insurance reports and other proceedings.
19. Information relating to specific assignments e.g. meeting records, project reports etc
20. CCTV footage and other information obtained through electronic means.
21. Building entry records.
22. Accident records if you have an accident at work.

We may also process the following “special categories” of personal data:

1. Information about your religion or belief and ethnic origin

1. Information about your health, including any medical condition, health and sickness records, including but not limited to:
2. Your disability
3. Determination of working capacity based on health conditions
4. Records of regular health examination
5. Sick-leave records
6. The reason for leaving considered to be ill-health, injury or disability, the records relating to that decision
7. The reason for leaving regarding your health, information about that condition needed for pensions and permanent health insurance purposes

1. Race
2. Genetic and biometric data
3. Information about criminal background

3. Collection of your personal data 3

The personal data you provide to us We typically collect personal data about you from the documents such as resume, curriculum vitae, or recruitment cover letter, job application, or verbal directly. Besides, we also collect the additional personal data when you fill out the form at the beginning of your employment, retaining or service outsourcing, for example, your bank information and relative details. Other details may be collected directly from you in the form of official documents such as a driver's license, passport, or other workplace rights.

The personal data from third party

We may collect the personal data from third parties such as recruitment agencies, background check provider or former employers.

The personal data you provide about third parties

If you give us information about another person, you confirm that the other person has appointed you to act on their behalf and agreed that you:

1. Shall consent on their behalf to processing of their personal data;
2. Shall receive any data protection Notices on their behalf;
3. Shall consent on their behalf to the transfer of their personal data abroad; and
4. Shall consent on their behalf to the processing of their “special categories” of personal data.

Monitoring

We may also monitor, intercept, read and/or record your telephone, email and other electronic for the purpose of monitoring and recording to establish facts, to establish compliance with regulatory procedures, to prevent or detect crime, to investigate or detect the unauthorized use of our systems or to ascertain compliance with our practices or procedures. We may also monitor and record communications to check that they are relevant to its business.

We may also use CCTV for the protection of employees and third party, and to protect against theft, vandalism and damage to goods and property. Generally, recorded images are routinely destroyed and not shared with third parties unless there is suspicion of a crime, in which case they are may be turned over to police or other appropriate government agency or authority.

4. Legal ground and purpose of personal data processing

We must have a legal ground to process your personal data. In most cases, the legal ground will be one of the followings:

1. to enable us to perform our contractual obligations as an employer (“Contractual obligations”)
2. to enable us to comply with legal obligations and for equal opportunities monitoring (“Legal obligations”)
3. to protect our legitimate interests (“Legitimate interests”) when your interests and fundamental rights do not override those interests
4. to protect public interest (“Public interests”)
5. to protect you or another person’s vital interest (“Vital interests”)
6. when you give us consent to the processing of your personal data for the specific purposes (“Consent”)

We have listed sample purposes and legal grounds for processing your personal data as follow:

Please note that some of the above grounds for processing may overlap and there may be multiple grounds which justify our possessing of your personal data.

Generally, we do not rely on consent as a legal ground for processing your personal data. However, we may ask for your consent to allow us to process certain particularly special categories of personal data.

If this occurs, you will be made fully aware of the purposes for the processing. When the legal ground to process your personal data is based on consent, you will have full control over your decision to give or withhold consent and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time. There will be no consequences where consent is withdrawn.

5. Sharing your data

We may share your personal data with the following parties:

1. colleagues within the Company;
2. Sojitz Corporation and its group companies;
3. professional advisors;
4. auditors;
5. insurance company; and
6. any third-party providing services to us for your benefit.

We may also share your data with third parties as part of the Company’s sale or restructure, or for other reasons to comply with a legal obligation upon us or with the government or other authorities to comply with the law.

6. Data transferred outside Thailand

Please be aware that your personal data may be transferred to, stored, and processed by us in our facilities with whom we may share your personal data in Japan and Singapore.

7. Retention period

We retain your personal data for as long as is necessary to achieve the purposes described in this Privacy Notice, which will be at least for the duration of your employment with us though in some cases we will keep your data for a certain period of time after your employment has ended.

Once you are no longer an employee, worker or contractor of the Company and we have no a legal ground to process your personal data, we will securely destroy or anonymise your personal data in accordance with our Privacy Notice, policies, laws and regulations.

8. Protecting your personal data

We are aware of the requirement to ensure your personal data is protected against accidental loss or disclosure, data destruction and abuse. To prevent problems, we have implemented the following processes and measures:

1. We have a measure restricting access to your personal data, which only employees, agents, contractors and other third parties that need to access to fulfil the mission and duties related to the service can access your personal data.
2. All service providers are permitted to process your personal data based on our instructions, they are subject to a duty of confidentiality, and they are required to be compliant and demonstrate the compliance with our policy and the law.
3. Our IT systems are protected against unauthorised access with various level of controlled and password protected access rights.
4. We have measures to share your personal data with third parties, with our written instructions to ensure that your personal data is processed safely and in accordance with the PDPA. Third parties must use appropriate technical and organizational measures to ensure the security of your personal data.

9. Your privacy rights

Under certain circumstance pursuant to the PDPA, you have rights to:

1. Request access to your personal data This enables you to receive a copy of the personal data that we hold about you and to check that we are processing it lawfully.
2. Request correction of the personal data that we hold about you This enables you to have any incomplete or inaccurate personal data that we hold about you corrected.
3. Request erasure of your personal data. This enables you to ask us to delete or remove your personal data where there is no legal ground for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.
4. Object to processing of your personal data This enables you to ask us to object to processing your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
5. Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data, for example if you want us to establish personal data accuracy or the reason for its processing.
6. Request the data portability of your personal data to another party.
7. Request withdraw the consent.

In circumstances where you have provided your consent to the processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time for processing your personal data. However, in some cases, we may continue to process the data where so permitted by having another legal ground for doing so.

10. Change of personal data

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

11. Making a complaint

The supervisory authority in the Thailand for data protection matters is the Office of the Personal Data Protection Committee (“PDPC Office”). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the PDPC Office.

12. Effective date and change to Privacy Notice

This Privacy Notice shall be effective on 1st June 2021 and we reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates.

13. Contact us about this Privacy Notice

If you have questions or comments about this Privacy Notice, you may contact our Data Protection Officer by email at [email protected], or by post to:

Personal Data Protection Team

Sojitz (Thailand) Co., Ltd.

Floor 19th, Q.House Lumpini Building 1 South Sathorn Road, Tungmahamek,

Sathorn, Bangkok 10120

Thailand