Personal Data Protection Notice for
Job Applicants, Internship Applicants, and Interns
บริษัท เสริมสุข จำกัด (มหาชน) and the companies within Thai Beverage Public Company Limited’s group of companies (collectively the “Companies”) recognize and respect the privacy and the protection of personal data of job Applicants, internship Applicants, and interns (collectively “You”). The Companies put in place this Personal Data Protection Notice, in order to notify You of the details related to a collection, use and disclosure of Your Personal Data (collectively the “Process”) in accordance with the personal data protection laws.
1. Purposes of Processing the Personal Data
1.1 The Companies will Process Your personal data for the following purposes:
| Purposes | Lawful Basis | |
| (1) | Performing according to Your request in relation to Your job application or internship application submitted to the Companies such as carrying out of the recruitment process, qualification verification, or candidates selection for entering into employment contracts including compliance with the terms and conditions of the internship program, paying remuneration of the internship program, and providing benefits and welfares of the internship program and qualification consideration in order to offering a suitable position to You. |
Contractual Legitimate Interests |
| (2) | Applying for the access of the electronic work system or enabling the right to access or use the internet or relevant electronic systems. | Legitimate Interests |
| (3) | Analyzing and creating databases, managing and improving the employee recruitment and selection processes, evaluating the internship results, sending news relating to positions, preparing an internship or employment contract in case You are qualified the selection process, and exercising legal claims | Legitimate Interests |
| (4) | Business planning, managing of risk, auditing including an internal auditing by the internal audit department and an internal management within the organization, including for the benefit of internal operations within the Companies in relation to the disbursement of payment of the accounting and finance department. |
Legitimate Interests |
| (5) | Compliance with laws or subpoena, letter or order of authorities, independent organizations or officers having lawful duties and authorities such as compliance with a summon, warrant of seizure, order of the courts, police officers, public prosecutors and government authorities including reporting or disclosing information to the shareholders, government authorities or independent organizations, i.e., the Office of Energy Regulatory Commission, the Ministry of Energy, the Revenue Department, the Land Department, the State Audit Office, the Office of National Anti-Corruption Commission, etc., for compliance with relevant laws. |
Legal Obligation |
| (6) | Compliance with laws concerning public interest in respect of public health such as health protection against dangerous communicable disease or epidemic which may be contagious or spread into the kingdom. | Legal Obligation |
| (7) | Managing Your heath, hygiene and safety. | Preventing or suppressing danger to a person's life, body or health (Vital Interests) |
1.2 In the event that the Companies will process Your personal data for any purpose other than the above purposes, The Companies may collect your additional personal data by notifying you and requesting Your consent from time to time (as the case may be).
2. Personal Data to be Collected
In general, the Companies will collect Your personal data by directly querying or requesting the data from you; however, there may be some circumstances that the Companies may collect Your personal data from other sources such as government authorities or other sources where your personal data are clearly and publicly disclosed including the personal data disclosed via social media, etc., in such case the Companies will choose to collect only the information you choose to be publicly available. In this regard, the type of Your personal data which will be processed by the Companies will be as follows:
2.1 Information contained in your application as follows:
(1) information specified in the documents provided by you to the Companies such as resume, Curriculum Vitae (CV), job application documents, annotations for employee recruitment;
(2) personal information such as name, surname, date of birth, status, address, identification card number or passport number, blood type, religion and marital status;
(3) contact information such as e-mail address, telephone number, address, online social media contact information;
(4) working conditions such as Your ability to work in other provinces or countries, Your preferred working location;
(5) information about/of Your spouse, children, father and mother such as name, surname, identification card number or passport, date of birth, nationality, blood type, education, address, telephone number. Please notify such
persons of details specified in this Notice prior to providing the aforementioned information to the Companies;
(6) information about your family members or person in your custody. Please notify such persons of details specified in this Notice prior to providing the aforementioned information to the Companies;
(7) pictures and motion pictures;
(8) information about Your education, capability, competency development, and other qualifications such as level of education, educational degree, institution/ university, educational background, training records, educational results, test results, right to work legally, professional qualifications, language abilities, other abilities, and any information from references provided by you to the Companies;
(9) information about your work experience and your past
employment such as job positions, employers’ information, salary, compensation, and benefits you received;
(10) information about your acceptable work location;
(11) information about military status;
(12) driving abilities;
(13) information about reference persons and contact person in case of emergency. Please notify such persons of details specified in this Notice prior to providing the aforementioned information to the Companies.
2.2 Information from Your characteristics test such as habits, behaviors, attitudes, aptitude, skills, leadership, teamwork, and emotional intelligence. This information may be collected from the Companies’ observation and analysis while You participate in the Companies’ activities.
2.3 Information necessary for reporting to regulatory agencies such as the Ministry of Labor.
2.4 Information collected from You, such as information specified or given by You to the Companies, information provided by You to the Companies during a job interview, Your information derived from test results, and information provided by
You during Your participation in the Companies’ activities.
2.5 Information You choose to share and disclose through the Companies’ systems, applications, tools, questionnaires, and other services.
2.6 Documents that can be used to identify Your identity, such as copies of documents issued by a government agency, e.g. identification card, driver's license for a car/motorcycle, passport, and copies of documents issued by a government or private agency, e.g., a copy of the house registration, diploma, degree certificate, transcript.
2.7 Other information necessary for recruitment and selection of employees and interns, compliance with an internship contract, provision of welfares and benefits, analysis, management, and legal compliance of the Companies.
2.8 For interns, the Companies may also collect additional information such as:
(1) information about parents or guardians such as name, surname,address, telephone number or mobile phone number;
(2) details of the account You have with the bank to be used for paying the internship remunerations;
(3) Your characteristics and information from the internship program such as behaviors, attitudes, aptitude, skills, leadership, teamwork, emotional intelligence, discipline, or other characteristics including records of Your work attendance, and working duration for evaluating the internship;
(4) other information such as details of the referrer;
(5) photographs, motion pictures and recording visual and/or audio from closed-circuit television cameras (“CCTV”) whereby the Companies will post a sign
indicating that CCTV is being used in the area under the Companies' responsibility;
(6) Record of work attendance and working duration, overtime working, whether on normal working day or on holiday, working on holiday, absence and leave, place of work;
(7) Information on usage and access to information systems, computers, work systems, websites, applications, network systems, electronic devices, e-mail
systems, to comply with the information technology security policy, including rules, regulations and measures for the use of information technology systems of the
Companies and related laws which include user account, password, Personal Identification Number (PIN), information about the electronic devices You use, such
as the reference number of the electronic device (IP Address), location data or other device identifier, the type and version of the browser You use, including the type
and version of the plug-in of the browser and time zone setting.
2.9 the aforementioned collected personal data are necessary for the Companies to perform their obligation pursuant to the agreements or Your request prior to entering into an agreement, if you refuse to provide such necessary personal data, the Companies may not be able to perform various operations relating to the transactions or the management in accordance with the agreements between You and the Companies (as the case may be).
2.10 In the event that You are selected to be an employee, the Companies will collect additional Personal Data as set forth in the Personal Data Protection Notice for Employees.
3. Sensitive Personal Data
3.1 The Companies may have to Process Sensitive Personal Data in accordance with the personal data protection laws for the purposes as notified by the Companies according to this Notice or any other purposes as the Companies additionally notify You or as per Your consent provided to the Companies on a case-by-case basis.
3.2 The Companies may have to Process Your Sensitive Personal Data as follows:
(1) health informationsuch as weight, height, personal congenital disease, color blindness, physical examination results, food allergy information, drug allergy information, blood group, doctor’s certificate, medical history for the purpose of labor protection, working ability assessment including compliance with relevant
laws;
(2) biometric data such as fingerprint and facial model simulationin order to identify and verify Your identity, prevent crime and safeguard legitimate interests
of the Companies or other persons;
(3) information about criminal records for considering Your suitability with the Companies’ operations and safeguarding legitimate interests of the Companies or other persons. The Companies will collect such information from the evidence provided by You or, with Your consent, verification with a relevant authority. The Companies will provide security measures to protect such information as required by laws;
(4) race, disability, trade union information for providing suitable facilities, activities and welfares to employees including for managing employees’ well-being equally and fairly in accordance with the human rights principles;
(5) other Sensitive Personal Data due to legitimate purposes, such as for protecting or restraining any danger to any person’s life, body or health, such Sensitive Personal Data is in public domain by Your express consent, for exercising legal claims, for achieving the objectives related to labor protection, social security, and employees’ welfare.
3.3 The Companies will request for Your express consent on a case-by-case basis for Processing Sensitive Personal Data and will provide adequate security measures to protect Your Sensitive Personal Data.
4. Cookies
In the event that You access any electronic device of the Companies such as applications, websites, information technology and cyber system, etc., the Companies use cookies for collecting Personal Data as specified in the Cookies Notice.
5. Withdrawal of Consent and Effect thereof
5.1 In the event that the CompaniesProcess Personal Data with Your consent, You have the right to, at any time, withdraw Your consent given to the Companies. Such withdrawal will not affect any Process of Personal Data performed by the Companies prior to the withdrawal of Your consent.
5.2 Your withdrawal of consent given to the Companies or refusal to provide certain information may result in the Companies being unable to meet all or certain purposes of the Companies as notified in this Notice or other purposes as the Companies additionally notify You or as per Your consent provided to the Companies on a case-by-case basis.
6. Personal Data of Other Persons
6.1 In the event that You provide Personal Data of other persons to the Companies, You have the following obligations:
(1) to notify such person of the details as specified in this Notice including to request a consent from such person (if Data Subject’s consent is required);
(2) to perform any necessary actions in order that the Companies are able to legally Process such person’s Personal Data.
6.2 Personal Data of other persons which may be Processed by the Companies include Sensitive Personal Data such as name, surname, date of birth, address, sex, information shown in an identification card or passport, nationality, e-mail address, telephone number, occupation, position, work location, financial documents, relationship with You, online social media contact information.
7. Personal Data of a Minor, Incompetent Person and Quasi-incompetent Person
7.1 In the event that the Companies have to obtain a consent for Processing Personal Data of a minor, incompetent person or quasi-incompetent person, the Companies will be able to Process Personal Data of such person only upon the Companies’ receipt of a consent of the holder of parental responsibility over the child, the custodian or the curator, or the person with authority to give consent in the name of such person in accordance with the personal data protection laws (as the case may be).
7.2 In the event that the Companies have to obtain a consent for Processing Personal Data of a minor, incompetent person or quasi-incompetent person but, at that time of data processing, the Companies are not aware that the Data Subject is a minor, incompetent person or quasi-incompetent person, and later becomes
aware that the Companieshad Processed the Personal Data of such person without consent of the person with authority to give consent in the name of such person in accordance with clause 8.1, the Companies will erase or destroy the Personal Data or anonymize the Personal Data of the Data Subject which is a minor, incompetent
person or quasi-incompetent personto become the anonymous data which cannot identify the Data Subject except in the event that the Companies can Process the Personal Data of such person by using lawful cause and without consent.
8. Period for Retaining the Personal Data
8.1 The Companies will retain Your Personal Data for a period necessary for achieving the purpose of such Personal Data Processing unless it is permitted to be retained longer by any law. If it is unable to be clearly identify the period for retaining the Personal Data, the Companies will retain Your Personal Data for a period that can be anticipated in accordance with the collecting standards, by taking into consideration a business practice for each type of Personal Data.
8.2 The Companies may retain Your Personal Data after completion of the selection process of the position You applied in order to consider and contact You in the event that there are other positions within the Companies that the Companies view that it is suitable for You, for a period of time necessary for achieving the purpose of application for employment or internship. If you do not
want the Companies to retain Your Personal Data to be considered for other positions,You can contact the Companies through the channels listed in this Notice.
8.3 If You are selected to be an employee or an intern, the Companies will continue to retainYour Personal Data for the duration that is necessary for achieving the purposes of Your employment or internship.
8.4 The Companies will retain Your Personal Data receiving from records of the CCTV for a period as follows:
(1) in normal circumstance, the Companies will retain Your Personal
Data for 1 year starting from the date the CCTV making such record;
(2) in necessary circumstance such as using as an evidence for an investigation, inquiry or trial or as requested by You, the Companies will retain Your Personal Data for more than 1 year starting from the date the CCTV making such record and the Companies will erase or destroy the Personal Data or anonymize Your Personal Data to become the anonymous data which cannot identify You once the performance for such purpose is completely finished.
8.5 In the event that the Companies Process Your Personal Data with Your consent, the Companies will Process Your Personal Data until the Companies receive Your withdrawal for such consent and the Companies finish proceeding with Your withdrawal request. However, the Companies will still retain Your Personal Data as necessary to make a record that You used to withdraw such consent in order that the Companies will be able to respond to Your request in the future.
9. Disclosure of Personal Data
9.1 The Companies may disclose Your Personal Data to the Companies, any person assigned by the Companies to be personal data processors and/or personal data protection officers, advisors, financial institutes, financial service providers, auditors, external auditors, credit rating companies, Partners, Business Partners,
service providers who are related to the process of employee recruitment and selection, employment, security, background check, qualification and ability test, service providers, contractors, sub-contractors who are related to business operations of the Companies to the extent that, associated with Personal Data, partners who are co-branding with the Companies, any natural persons and/or
juristic persons who have relationship or legal relation with the Companies, any persons who are interesting in receiving the assignment of The Companies’ rights and obligations, any persons who intend to have a merger transaction with the Companies in any manner, any organization related to sustainability index, infirmary
and/or rescue forces (in case of emergency for protecting Your benefits), government authorities, regulatory authorities, legal authorities, any persons who request the Companies to disclose Your Personal Data with legal power and/or in compliance with any agreements You are a party thereto and/or any natural persons
or juristic persons as necessary, whether inside or outside Thailand, (including staff members, employees, executives, directors, shareholders, agents and advisors of the Companies and of the aforesaid recipients) in order that the Companies will be able to operate their businesses and provide services to You including to comply with the purposes of Personal Data Processing as specified in this Notice or other purposes as the Companies will additionally inform You or in accordance with Your consent given to the Companies on a case-by-case basis and/or to act in compliance with the laws.
9.2 The Companies will cause the recipients of Your Personal Data to have appropriate security measures for protecting Your Personal Data and to Process Your Personal Data only to the extent as necessary, and to prevent any use or disclosure of Your Personal Data by any other persons without lawful authority.
9.3 The Companies will cause the recipients of Your Personal Data to keep such Personal Data in confidence and not use it for any purposes other than the purposes of Personal Data Processing under this Notice or other purposes as the Companies will additionally inform You or in accordance with Your consent given to the Companies on a case-by-case basis and/or to act in compliance with the laws.
10. Sending or Transferring Personal Data to Foreign Countries
In the event that the Companies is required to send or transfer Your Personal Data to any foreign country including to keep Your Personal Data on any database in any foreign country, the Companies will ensure that a transferee or data retention service provider in such destination country has adequate data protection standard to protect the Personal Data in accordance with those specified in the personal data protection laws of the country of transferer of such Personal Data (if any). If the transferee or data retention service provider in such destination country has data protection standard to protect the Personal Data lower than those specified in the personal data protection laws of the country of transferer of such Personal Data, the
Companies will perform as appropriate and necessary in order that the Personal Data transferred to such foreign country are protected in the same level as the Companies protect Your Personal Data.
11. Security Measures for Personal Data Protection
11.1 The Companies will strictly set up the right to access, use, modify, revise or disclose the Personal Data including to display or confirm the identityof a person who accesses or uses the Personal Data in compliance with the standards for safeguarding the Personal Data as specified in the personal data protection laws.
11.2 The Companies will set up an appropriate technological procedure to prevent any access to information technology system without permission.
11.3 In the event that the Companies disclose Your Personal Data to any third person, the Companies will perform any action to prevent such person from illegal or unauthorized use or disclosure of the Personal Data so that such person will only use Your Personal Data as necessary and in accordance with the purposes as the Companies notifie You and/or in accordance with Your consent on a case-by-case basis.
11.4 The Companies will set up a monitoring system for erasing or destroying Personal Data from the collecting system once the retention period for such Personal Data ends or once such Personal Data is excessive or no longer related to the data processing purposes or upon Your request or withdrawal of consent.
11.5 In the event that there is a violation of The Companies’ security measures for Personal Data which causes an infringement of Your Personal Data, the Companies will, without delay, notify such infringement to a competent authority as specified in the personal data protection laws unless there is no risk that such infringement will affect Your personal rights and freedom. If there is high risk that such infringement will affect Your personal rights and freedom, the Companies will, without delay, notify You of such infringement together with remedial guidelines in accordance with the criteria and procedures specified in the personal data protection laws.
11.6 The Companies will record any transactions as specified in the personal data protection laws in writing or on electronic system so that the Data Subject or any authority under the personal data protection laws be able to make an examination thereon.
12. Rights of Data Subject
12.1 You, as a Data Subject, have the rights to deal with Your Personal Data which are in the Companies’ responsibility in accordance with the personal data protection laws as follows:
(1) to request access to or obtain copy of Your Personal Data or to request the disclosure of the acquisition of Your Personal Data obtained without Your consent;
(2) to obtain Your Personal Data in electronic form or transfer Your
Personal Data to other persons;
(3) to object to the collection, use, or disclosure of Your Personal Data in accordance with the personal data protection laws;
(4) to erase or destroy Your Personal Data, or to anonymize Your Personal Data to become the anonymous data which cannot identify You in accordance with the personal data protection laws;
(5) to restrict the use of Your Personal Data in accordance with the
personal data protection laws;
(6) to revise or modify Your Personal Data to be accurate, up to date, complete and not misleading;
(7) to withdraw Your consent given to the Companies unless there is any restriction for consent withdrawal by laws or any agreement which gives benefits to
You;
(8) to complain to any authority if You believe that any dealing with the Personal Data by the Companies is incompliance with the personal data protection
laws.
12.2 You can use the right as specified in clause 13.1 by contacting the person specified in clause 15 hereof.
12.3 The Companies reserve the right to refuse to perform according to Your request, whether in whole or in part, if the Companies have reasonable and lawful reason such as such performance will cause unreasonable burden to the Companies, is impracticable, is illegal or the use of such right by You will or may affect other person’s rights or freedom or in the event that the Companies have a legal authority to collect Your Personal Data without your consent.
13. Privacy Notice or Privacy Policy of other Websites or Applications
In the event that You use the Companies’ websites or applications and You clicks any link shown on such websites or applications to enter into other websites or applications, whether such other websites or applications belong to the Companies or not, You agree to read and comply with the Privacy Notice or Privacy Policy of such other websites or applications, and the Companies will not be responsible for any contents or data protection standards to protect the Personal Data of such other websites or applications. Moreover, if You give Your Personal Data to the owners of other websites or applications, You acknowledge and understand that the Companies arenot relevant to processing of Your Personal Data by the owners of such other websites or applications.
14. Details of Data Controller and Personal Data Protection Officer
You can contact the data controller and/or personal data protection officer of the Companies through the following channels:
PDPA Contact Center
Tel. 0-2975-5566 or E-mail pdpa_info@sermsukplc.com
15. Revision of Personal Data Protection Notice
In the event that there is any revision to this Notice, the Companies will make an announcement via the Companies’ website or application, or other communication channels of the Companies and the new Notice will be effective on the date of such announcement.