Personal Data Protection Notice for Employees
Thai Beverage Public Company Limited and the companies within Thai Beverage Public Company Limited’s group of companies (collectively the “Companies”) recognize and respect the privacy and the protection of personal data of employees (collectively “You”). The Companies put in place this Personal Data Protection Notice, in order to notify You of the details related to a collection, use and disclosure of Your Personal Data (collectively the “Process”) in accordance with the personal data protection laws.
1. Purposes of processing the Personal Data
1.1 The Companies will Process Your personal data for the following purposes:
| Purposes | Lawful Basis | |
|---|---|---|
| (1) | Preparing employment contracts or agreements, performing obligations according to employment contracts, making payments of Your remunerations or other benefits. | Contractual |
| (2) | Compliance with rules and regulations relating to human resource management, company’s code of conduct, assignment of works, transfer of employees, change of employers, sending employees to work in other companies and/or organizations (Secondment), training, evaluation of employee’s performance, consideration of position and remuneration. | Contractual Legitimate Interests |
| (3) | Performing according to Your request of medical expense and reviewing requests for medical expenses. | Contractual Consent |
| (4) | Managing human resources such as analysis and allocation of manpower, employees’ development, provision of medical, insurance and other welfare of employees, employee activities, financial and budget management, internal and external correspondence, registration process, authorization process, preparation of certificates, documents for publication and reports, identification and verification of the accuracy of information received from employees, analysis and preparation of databases of work experiences and contact information, public relations, improvement of working environments, provision of facilities, monitor and control the efficiency of work systems, and care for employees after termination of employment. | Contractual Legitimate Interests |
| (5) | Safeguarding Information Security, creating user account, identifying user for accessing work systems and information systems. | Legitimate Interests |
| (6) | Using as information and supporting documents for any proceeding with banks, financial institutions, the Department of Business Development, the Revenue Department, the Excise Department, the Stock Exchange of Thailand, the Office of Securities and Exchange Commission and other relevant external organizations. | Legitimate Interests |
| (7) | Publicizing information through relevant channels such as internal email of the Companies, the Companies’ website, Facebook, LINE, YouTube or other online media of the Companies or other media such as television and publication. | Legitimate Interests Consent |
| (8) | Business planning, reporting, forecasting, managing risk, auditing including internal auditing, and internal management within the organization, including operations within the Companies in relation to the disbursement of payments of the accounting and finance department. | Legitimate Interests |
| (9) | Proceedings in relation to the assignment of any right, duty and benefit such as merger and acquisition, separation or business transfer which has been lawfully conducted. | Legitimate Interests |
| (10) | Communicating and providing benefits to employees both while they are the Companies’ employees and after their termination of employment. | Legitimate Interests |
| (11) | Investigating and inquiring complaints within an organization, preventing corruption, considering discipline pursuant to rules, regulations, work regulations, providing security, preventing accidents and criminal activities, monitoring and inspecting the Companies’ assets or any other legal proceeding. | Legitimate Interests |
| (12) | Compliance with relevant laws such as labor protection law, labor relations law, social security law, workmen’s compensation law, provident fund law, empowerment of persons with disabilities law, safety, occupational health and environment at work law, communicable diseases law, tax law and laws related to insurance and life insurance. | Legal Obligation |
| (13) | Compliance with laws concerning public interest in respect of public health such as health protection against dangerous communicable disease or epidemic. | Legal Obligation |
| (14) | Managing Your hygiene and safety. | Preventing or suppressing danger to a person's life, body or health (Vital Interests) |
1.2 In the event that the Companies will Process Your personal data for any purpose other than the above purposes, the Companies may collect Your additional personal data by notifying You and requesting Your consent from time to time (as the case may be).
2. Personal Data to be Collected
In general, the Companies will collect Your personal data by directly querying You or requesting the data from You; however, there may be some circumstances that the Companies may collect Your personal data from other sources such as government authorities or other sources where Your personal data are clearly and publicly disclosed including the personal data disclosed via social media, etc., in such case the Companies will choose to collect only the information You choose to be publicly available. In this regard, the type of Your personal data which will be Processed by the Companies will be as follows:
2.1 Information and documents related to employee recruitment provided by You to the Companies such as resume, Curriculum Vitae (CV), job application documents, annotations for employee recruitment, etc.
2.2 Your personal information such as name, surname, gender, date of birth, weight, height, identification card number or passport number, blood type, religion and marital status, interests, opinions, etc.
2.3 Contact information such as address, e-mail address, telephone number, Line ID, online social media contact information.
2.4 Working conditions such as Your ability to work in other provinces or countries and Your preferred working location.
2.5 Information about/of Your spouse, children, father and mother such as name, surname, identification card number or passport, date of birth, nationality, blood type, education, address, telephone number.
2.6 Information about family members or persons in the Employees’ custody who are eligible to receive benefits in accordance with the Companies’ rules and regulations on human capital management such as beneficiaries, etc.
2.7 Photographs, motion pictures and recording visual and/or audio from closed-circuit television cameras (“CCTV”).
2.8 Information about Your education, capability, competency development, and other qualifications such as educational background, training records, educational results, test results, right to work legally, professional qualifications, language abilities, other capabilities, and references provided by You.
2.9 Information about Your work experience, working history prior to and after being employed within the Companies as follows:
2.10 Information about military status.
2.11 Information about reference persons and contact person in case of emergency. Please notify such persons of details as specified in this Notice prior to providing the aforementioned information to the Companies.
2.12 Information about Your characteristics such as habits, behaviors, attitudes, aptitude, skills, leadership, teamwork, and emotional intelligence, corporate commitment, etc.
2.13 Information necessary for reporting to regulatory agencies such as the Ministry of Labor, the Stock Exchange of Thailand, the Securities and Exchange Commission (SEC), Thai Institute of Directors Association (IOD), Singapore Exchange (SGX), etc.
2.14 Financial information such as information about wage, salary, income, tax, provident fund, bank account, loans, tax exemptions or deductions, etc.
2.15 Information relating to social security, compensation, labor protection, labor relations, privilege, welfare, and benefits that You receive or are entitled to receive.
2.16 Records of attendance and working duration, overtime working, working on holidays, absence and leave, and place of work.
2.17 Information on usage and access to information technology systems, computers, work systems, websites, applications, network systems, electronic devices, and e-mail system, including user account, password, PIN, device reference number (IP Address), location data, browser type and version, plug-ins, and time zone setting.
2.18 Information collected from Your participation with the Companies such as activities participation and surveys and assessments response, etc.
2.19 Information You choose to share and disclose through the Companies’ systems, applications, tools, questionnaires, assessment forms, and other documents.
2.20 Copy of documents that can be used to identify Your identity such as an identification card, passport, and other documents issued by government agencies.
2.21 Copy of work permits or relevant professional licenses (if any), and educational documents.
2.22 Information about Your vehicles such as vehicle registration number, brand, color, driver’s license, car and/or motorcycle registration document, driving ability, and in case of a vehicle provided by the Companies, information about Your driving behavior.
2.23 Other information necessary for investigating conflicts of interest, such as information regarding stock holding and Your relationship with Partners, Business Partners and/or natural persons or juristic persons who are connected persons and/or competitors of the Companies.
2.24 Information about accidents whether the accidents occur during working hours or are related to work, and other accidents.
2.25 Other information necessary for compliance with Your employment contract, provision of welfare and benefits, the Companies’ analysis and administration, taking care of Employees after they no longer work for the Companies, and compliance with applicable laws.
2.26 Information regarding whistleblowing, investigation, complaints, and disciplinary actions.
2.27 Information regarding the screening according to epidemic prevention measures. The aforementioned personal data is necessary for the Companies, and if You decline to provide personal data required for compliance with laws or contracts, obligations under such contracts and Your rights to access benefits or services provided by the Companies may not be completely performed.
3. Sensitive Personal Data
3.1 The Companies may have to Process Sensitive Personal Data in accordance with the personal data protection laws for the purposes as notified by the Companies according to this Notice or any other purposes as the Companies additionally notify You or as per Your consent provided to the Companies on a case-by-case basis.
3.2 The Companies may have to Process Your Sensitive Personal Data as follows:
3.3 The Companies will request for Your express consent on a case-by-case basis for Processing Your Sensitive Personal Data and will provide adequate security measures to protect Your Sensitive Personal Data.
4. Cookies
In the event that You access any electronic device of the Companies such as applications, websites, information technology and cyber system, etc., the Companies use cookies for collecting Personal Data as specified in the Cookies Notice.
5. Withdrawal of Consent and Effect thereof
5.1 In the event that the Companies Process Personal Data with Your consent, You have the right to, at any time, withdraw Your consent given to the Companies. Such withdrawal will not affect any Process of Personal Data performed by the Companies prior to the withdrawal of Your consent.
5.2 Your withdrawal of consent given to the Companies or refusal to provide certain information may result in the Companies being unable to meet all or certain purposes of the Companies as notified in this Notice or other purposes additionally notified to You.
6. Personal Data of Other Persons
6.1 In the event that You provide Personal Data of other persons to the Companies, You have the following obligations:
6.2 Personal Data of other persons which may be processed by the Companies include name, surname, date of birth, address, sex, information shown in an identification card or passport, nationality, e-mail address, telephone number, occupation, position, work location, financial documents, relationship with You, and online social media contact information.
7. Personal Data of a Minor, Incompetent Person and Quasi-incompetent Person
7.1 In the event that the Companies have to obtain consent for Processing Personal Data of a minor, incompetent person or quasi-incompetent person, the Companies will process such Personal Data only upon receipt of consent from the holder of parental responsibility, custodian, curator, or person with authority to give consent.
7.2 If the Companies are not aware at the time of processing that the Data Subject is a minor, incompetent person or quasi-incompetent person, and later become aware that the Companies had Processed such Personal Data without proper consent, the Companies will erase, destroy or anonymize the Personal Data unless there is another lawful cause to continue processing without consent.
8. Period for Retaining the Personal Data
8.1 The Companies will retain Your Personal Data for a period necessary for achieving the purpose of such Personal Data Processing unless it is permitted to be retained longer by any law.
8.2 The Companies will retain Your Personal Data throughout the duration of Your employment within the Companies for compliance with the contract and will continue to retain it for the necessary period after termination of employment.
8.3 The Companies will retain Personal Data of Your family members or persons in Your custody for a period necessary for achieving the purpose of this Notice.
8.4 The Companies will retain Your Personal Data receiving from records of the CCTV for a period as follows:
8.5 In the event that the Companies Process Your Personal Data with Your consent, the Companies will Process Your Personal Data until the Companies receive Your withdrawal and finish proceeding with Your withdrawal request.
9. Disclosure of Personal Data
9.1 The Companies may disclose Your Personal Data to the Companies, any person assigned by the Companies to be personal data processors and/or personal data protection officers, advisors, financial institutions, service providers, auditors, Partners, Business Partners, contractors, sub-contractors and any necessary persons or entities in order that the Companies will be able to operate their businesses, provide services to You, comply with the purposes of Personal Data Processing specified in this Notice, or act in compliance with the laws.
9.2 The Companies will cause the recipients of Your Personal Data to have appropriate security measures and to Process Your Personal Data only to the extent necessary.
9.3 The Companies will cause the recipients of Your Personal Data to keep such Personal Data in confidence and not use it for any purposes other than those specified.
10. Sending or Transferring Personal Data to Foreign Countries
In the event that the Companies are required to send or transfer Your Personal Data to any foreign country including to keep Your Personal Data on any database in any foreign country, the Companies will ensure that a transferee or data retention service provider in such destination country has adequate data protection standards in accordance with applicable law.
11. Security Measures for Personal Data Protection
11.1 The Companies will strictly set up the right to access, use, modify, revise or disclose the Personal Data including to display or confirm the identity of a person who accesses or uses the Personal Data.
11.2 The Companies will set up an appropriate technological procedure to prevent any access to information technology systems without permission.
11.3 In the event that the Companies disclose Your Personal Data to any third person, the Companies will perform any action to prevent such person from illegal or unauthorized use or disclosure.
11.4 The Companies will set up a monitoring system for erasing or destroying Personal Data from the collecting system once the retention period ends or once such Personal Data is excessive or no longer related to the data processing purposes.
11.5 In the event that there is a violation of the Companies’ security measures for Personal Data which causes an infringement of Your Personal Data, the Companies will, without delay, notify a competent authority and when required notify You together with remedial guidelines.
11.6 The Companies will record any transactions as specified in the personal data protection laws in writing or on electronic systems.
12. Rights of Data Subject
12.1 You, as a Data Subject, have the rights to deal with Your Personal Data in accordance with the personal data protection laws as follows:
12.2 You can exercise the rights specified above by contacting the person specified in clause 14.
12.3 The Companies reserve the right to refuse to perform according to Your request, whether in whole or in part, if the Companies have reasonable and lawful grounds to do so.
13. Privacy Notice or Privacy Policy of other Websites or Applications
In the event that You use the Companies’ websites or applications and click any link shown on such websites or applications to enter into other websites or applications, whether such other websites or applications belong to the Companies or not, You agree to read and comply with the Privacy Notice or Privacy Policy of such other websites or applications. The Companies will not be responsible for any contents or data protection standards of such websites or applications.
14. Details of Data Controller and Personal Data Protection Officer
You can contact the data controller and/or personal data protection officer of the Companies through the following channels:
Helpdesk HC Telephone: 02-078-5858 E-mail: helpdesk.hc@thaibev.com
PDPA Contact Center Helpdesk HC 02-078-5858 or helpdesk.hc@thaibev.com
15. Revision of Personal Data Protection Notice
In the event that there is any revision to this Notice, the Companies will make an announcement via the Companies’ website or application, or other communication channels of the Companies, and the new Notice will be effective on the date of such announcement.