Data Privacy and Protection Policy
Kingfisher Holdings Limited and Affiliated Companies
Introduction
Kingfisher Holdings Limited and affiliated companies (“The Company”) has an intention to monitor, manage and execute the personal data information including personal data collection, usage and disclosure the personal data. This is also to include security of personal data kept and can be brought up to use in accordance with Personal Data Protection Act and other related laws. Thus, to manage and monitor properly, Data Privacy and Protection Policy is written to provide guidelines pertaining personal data management. If there are any changes, alteration, modification and adjustment, The Company will arrange to update all concerns in timely manner with via accessible channel.
1. Personal Data
1.1) Type of Personal Data Information
In this policy,
Personal Data means that the information relating to a person which enables the identification of such person whether directly or indirectly, but not including the information of deceased persons in particular.
Sensitive Information means that any information relating to a particular person which is sensitive and presents significant risks to the person’s fundamental rights and freedoms which include data regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disabilities, trade union information, genetic data, biometric data, or any data which may affect the Data Subject in the same manner, as prescribed by the Personal Data Protection Committee.
1.2) Collection of Personal Data
The collection of Personal Data shall be limited to the extent necessary in relation to the lawful purpose of the Data Controller.
In case The Company needs to collect the personal data base on the consent, The Company will inform Data Subject to gain acknowledge and consent pertaining to purpose of collection, usage, disclose, duration of retaining the personal data, third party who receiving the personal information, Data Protection Officer and rights of data subject prescribed by law.
In case The Company needs to collect sensitive data, The Company shall request explicit consent from data subject for consent before such a collecting, usage, and disclosure of personal data.
1.3) Personal Data that the company shall collect
Will include but not limit to such personal data information in particular as following;
· Name, last name, nick name, Identification Card Number, Passport Number, date of birth, place and country of birth.
· Permanent and mail address, phone number, email address, face book account and line account.
· Working experience, education back ground, skills, qualifications and record of training development.
· Salary information, compensation information, bank account number
· Photographs, photo filing, and audio filing
· Data relating to person activities such as log file
· Data relating to social media
· Employee opinion that is kept by The Company or third party
· Data subject opinion on The Company relating company products and services through customer satisfaction survey
· Data relating visiting website and/or company portal of individual
1.4) Origin of Personal Data
The Company shall obtain the personal data information through these 3 channels.
1) Directly obtain from data subject through the methods below;
a. Job application that data subject submits once applying through vacant positions.
b. Data subject sends as The Company customers
c. Data subject apples to be company service providers
2) Data subject intentionally completes The Company survey or responds to The Company on business purposes i.e. email correspondence or other mass media between company and data subject.
3) Data subject visits company website through Cookies
2. Purposes of Personal Data Processing
1) In case the data subject is employee of The Company, The Company will process the personal data of employee for the purpose of employment including other purposes relating to employment.
2) Process as required by government agencies as prescribed by law.
3) Execute in accordance with related laws or acts.
4) Other purposes in which company will notify in advance before processing personal data and this will be in accordance with law required.
5) To ensure that processing is well managed properly and consistence to related laws, guideline and other procedures. This includes the execution as per law required which is currently enforced and/or for future modifications.
6) For the purpose of personal identification of data subject once contacting The Company in placing order or receiving services.
7) To improve the working capacity of customer services i.e. customer relations and real time customer delivery.
8) To contact via phone, send SMS, email or post mails and/or other channels on the purpose of service / product enquiry or notify data subject or customer opinion survey.
9) For other benefits related to company business purpose, education, research, statistic, product development, services, plan and marketing analysis, marketing activity or other advertisement including public relations, promotion campaign and others to meet with customer interest.
10) To provide convenient way for customers in notify, send, product and service payment related to products and services.
11) To provide after sales service as requested including answering all related enquiries, giving information, and receiving customer compliant.
12) To ensure the safety and security in the workplace and other affiliated companies such as security camera.
13) To record conversation and/or other communications between company and data subject such as email, conversation through digital channels for the purpose of development of company services and products.
14) To execute the conclusion of execution, claims, appeals, debt calling and enforce settlement.
15) To ensure the safety and security of the person and that person is in a good health.
16) To support other purposes described by law in giving the authority to collect, usage, disclosed without any concerns from subject data.
17) To follow and comply with internal policy of company and other affiliated companies.
18) To provide services to company and affiliated companies and company alliances or other companies dealing with which may be located in Thailand or aboard.
If The Company changes and adjust the company purposes pertaining to processing personal data, The Company will inform all concerns via company website.
3. Personal Data Processing
Once The Company receives the personal data information The Company will execute the personal data as below;
1) Collect: The Company will only process personal data that are needed for employment in case of employment, customer contract, personal dealing with company. In this regards, the personal data being processed on contract base does not need to get any consent from data subject.
2) Usage: The Company needs to gain consent from data subject under this principle and if data subject intends to withdraw the consent, he or she can proceed to contact The Company. However, the withdrawing will not impact the personal data processing that data subject has already given consent.
3) Disclosed: The Company will ensure to not disclose or illustrate or demonstrate any personal data that will against with purposes of personal data collection except receiving consent from data subject or process as per law required.
4. Retention of Personal Data and Duration of Retention
1) The Company is to keep personal data in hard copy and/or electronic file with high safety and security standard to protect from lost and stolen including accessing from unauthorized person.
2) The Company is to keep personal data within the time frame necessary needed or within the contractual time frame or obligation by law between data subject and The Company or within time frame that can claim legally of both parties agreement. Once the time frame is passed and The Company has no legal right to retain such personal data, The Company will destroy, delete personal data or manage to ensure that such personal data cannot be used to identify the person.
5. Right Of The Data Subject
1) Right to withdraw consent: data subject has got right to withdraw the consent from the data processing given to The Company.
2) Right to access: data subject has got right to access to and obtain the copy of personal data including the requisition to company to disclose of origin of personal data.
3) Right to rectification: data subject has got right to correct his/her personal data to be up-to date and complete.
4) Right to erasure: data subject has got right to delete his/her personal data.
5) Right to restrict of processing: data subject has got right to hold and restrict from processing his/her personal data.
6) Right to data portability: data subject has got right to transfer his/her personal data to other data controllers.
7) Right to objection: data subject has got right to object the processing of his/her personal data if they have not given their consent.
6. Disclosure the Personal Data to Other Persons or Other Parties
The Company will not disclose personal data to others without prior permission from data subject. However, for the purpose of personal data collection and retention, The Company may disclose the personal data to other persons as followings;
1) Kingfisher Holdings and affiliated company in Thailand and outside Thailand.
2) Persons or other companies who are hired to process personal data for the benefit of company operation management i.e. information technology services provider, data and statistical analysis, research and new product development.
3) Business partners and trade partners
4) The Company may disclose personal data of employee as required by law i.e. government agencies, labour department including other mandated from government agencies due to court orders.
7. Marketing Activities and Marketing Promotion
During service period, The Company will send the information of marketing activities, marketing promotion, products and company services as a part of company services to any interested persons. All interested persons has got full right to stop receiving these information at any time by writing an email to notify The Company.
8. Data Protection officer (“DPO”)
Any individual who wants to notify, contact and claim The Company pertaining to personal data information shall process to contact Data Protection Officer (“DPO”) and The Company will take 30 days to respond back.
Contact Information
Data Controller Information
Location Kingfisher Holdings Limited
Contact Detail 034 419 888
Data Protection Officer Detail
Location Kingfisher Holdings Limited
Contact Detail 034 419 888 ext 202
Email Address DPO@kingfisher.co.th
9. Review and Changes of Policy
The Company may review this Data Privacy and Protection Policy from time to time to ensure that it remains in adherence to laws. Any significant business changes, the company shall announce distribution data through company website within proper time frame.
