KINGFISHER HOLDINGS LIMITED

Letter of Consent for Data Collection, Use, and/or Disclosure of Personal Data for Job Applicants

Kingfisher Holdings Company Limited and its affiliates (hereinafter “the Company”) attaches great importance and is committed to the protection of personal data of data subjects (hereinafter the “Applicant”) who have applied for a job with the Company. The Company has therefore implemented measures appropriate to the maintenance of personal data security, in particular, the collection, processing, use, and/or disclosure of the Applicant’s personal data as well as the guidelines for compliance with the Personal Data Protection Act 2019 (B.E. 2562) and laws related to personal data. This is to inform the Applicants for their acknowledgement and understanding of the protection of Applicant’s personal data as follows.

Personal Data collected by the Company

The Company receives the Applicant’s personal data, and the information is collected and processed according to this consent letter to the collection, processing, use, and/or disclosure of this personal data. The Company collects and processes personal data as necessary for the purposes of collecting, processing, using, and/or disclosing personal data of the Company. The types of personal data are classified as follows:

Type of personal data	Details
Basic personal data	Such as title, first name, surname, nickname, photograph, signature, ID card number, current address, e-mail, phone number, date, month and year of birth, age, marital status, military service status, educational background, work history, credit record
Technical data for applicants applying through the Company’s website	Such as data about websites and systems accesses, computer traffic data, contact data and communication between data subjects and other users, logging data such as device identifiers, computer IP address, identity number, device, device type, mobile network data, connection data, geolocation data, browser type, logs of various systems or websites accessed before and after, system log data, office time in and out log data, system access log data, transaction log data, data usage behavior, login statistics, visit times collected through cookies or other similar technologies.

Data Collection

1. Personal data received directly from applicants

The Company receives the personal data of applicants directly by collecting personal data from the recruitment and recruitment process or the consent letter.

2. Applicant’s personal data received from a third party

The Company may collect data from other organizations for the recruitment and selection process, such as in the case of applicants applying for jobs through recruitment agencies or job search websites.

3. Personal data of other persons that the applicant has provided to the Company which the personal data of other persons may be provided as an emergency contact which the Company will use only when the matter is related to the job application only.

4. The Company may store information about your access to the website by storing the following information: IP number or access time, etc.

Data Processing Bases and Objectives

The Company will process the Applicant’s personal data with a scope, purposes, and using methods that are legal, transparent, and fair under the following processing bases.

1. To fulfill the Company’s employment contract’s obligations or to be used to process requests prior to becoming an employee of the Company according to the job application process.

2. For the necessity of complying with the law and for the legitimate interests of the Company which will not infringe upon the fundamental rights or freedoms of the data subject.

3. To collect information as a company database or statistical information about the number of visitors to the website.

The Company will process the Applicant’s personal data as necessary to assess the Applicant’s suitability for the position and to verify the accuracy of the information provided to the Company.

Data collection objectives	Details
1. For the recruitment process	1) The Company uses the applicant’s personal data to assess whether the applicant is suitable for the role in the position the Company intends to recruit and to handle interviews or assessments when the Applicant has applied for a job either directly with the Company or through a recruitment agency or a third party. This will include contacting the Applicant to prepare, process, evaluate and provide feedback on assessments and interviews, including in the event that the Company offers employment to job applicants. 2) To assess whether or not the Applicant is suitable for the position that he/she has applied for. The Company may ask the Applicant to answer questions about personality details where such information may be obtained either from the Applicant or from the Company. 3) Managers in the recruiting agency or related departments of the Company may select applications for interviews based on details provided by the applicants for the job application.
2. To verify employment history before hiring	1) To check whether the Applicant has previously worked with the Company and the reason for leaving, including verifying whether the Applicant has applied for a job with the Company before as well as to see whether the Applicant has an interest for other positions in the Company. 2) To carry out verification process before hiring and assess the Applicant’s work competencies under the permission of the law. These include professional qualifications, credit bureau information, criminal records, and conducting reference checks with contacts that the Applicant has provided to the Company.
3. To consider other suitable positions in the future	1) If the Applicant did not pass the assessment to be hired for the position applied, the Company will store the Applicant’s details in the Company’s database for 2 years for the Company to be able to contact the Applicant should there be any suitable positions in the future. 2) If the Applicant requires the information to be removed, the Applicant may contact the Company’s Human Resources Department.

Restrictions on the use or disclosure of personal data

1. The Company will use or disclose and display the Applicant’s information only to the extent necessary for the objectives of personal data collection. The Company will supervise its employees or related persons of the Company to strictly refrain from using or disclosing the Applicant’s personal data to outsiders or third parties.

2. The Company will not disclose information or display information or make it appear in any other part of personal data that is inconsistent with the purpose as agreed by the Applicant. The Company will maintain the confidentiality of the Applicant’s information unless the law requires otherwise.

3. The Company may transfer personal data of the Applicant to companies in the Kingfisher Holdings Limited Group and its affiliates for the purpose of recruitment and selection.

4. The Company has limited the right to access, use, or disclose the Applicant’s personal data to specific relevant agencies and people within the company only.

Personal data storage period

The Company will store the Applicant’s personal data for a period of 2 years from the end of the Applicant’s final interview process, unless the Applicant has been selected to work as an employee of the Company, in which case the Company will continue to collect your personal data for the period necessary to achieve the Company’s objectives or for the event of necessity under an order from a government agency or court order.

The Company will provide an audit system for deletion or destruction of personal data after the expiration of the retention period or data which is unrelated to or beyond the necessity for the purpose of collecting that personal data.

Rights of data subjects

Rights of the Applicant in accordance with the Personal Data Protection Act 2019 (B.E. 2562) are as follows:

1. The right to be informed by being notified regarding the processing of personal data, methods of collection, to whom it will be given to, reasons, and period of storage.

2. The right to request access and obtain a copy of personal data responsible by the Company or request disclosure of the acquisition of such personal data without consent.

3. The right to automatically obtain personal data relevant to yourself from the Company and request the transmission or transfer of personal data to the data protection officer or by automated means.

4. The right to object to the collection, use, or disclosure of personal data related to the personal data subject.

5. The right to request the Company to delete or destroy or make the data subject non-identifiable from the personal data.

6. The right to request the Company to suspend the use of personal data.

7. The right to correct personal data by requesting the Company to rectify the personal data so that it is accurate, current, complete, and not misleading.

8. The right to withdraw the consent given to the Company for the collection, processing, use, or disclosure of personal data.

In this regard, the Applicant has the right to submit a request to exercise the right to make a complaint to the Company. In some cases, the Company may refuse the request to exercise the right according to the reasons that will be provided at a later date. However, the Applicant may complain to the Office of the Personal Data Protection Committee if he/she does not agree with the reasons clarified by the Company.

Any request for the exercise of the above-mentioned rights the Applicant must make in writing and the Company will use its best efforts to take action or provide a clarification within 30 days or not exceeding the time required by law as well as ensuring its compliance with the legal requirements related to the rights of the Applicant as a data subject. In the event of requesting the Company to delete, destroy, dispose of the processing of personal data, temporarily suspend its use, transform personal data into an anonymous form, or withdrawing consent may result in limitations for the Company to act in accordance with the relevant law. In this regard, for the exercise of the above rights, the Company reserves the right to charge related expenses and is necessary for the processing of personal data as requested by the Applicant.

Contacting the Company

Applicants may contact the Company’s Human Resources Officer in case of questions, suggestions based on their consent for the collection, processing, use, and/or disclosure of information or to request the exercise of the data subject’s rights at:

Human Resources Department Officers

Kingfisher Holdings, Ltd. No. 1, Moo 4, Ban Plai Klong Khru Road, Na Di Subdistrict, Mueang District, Samut Sakhon 74000; Tel: 034 419 888 ext. 474

Southeast Asian Packaging and Canning Company Limited; No. 1, Moo 4, Ban Plai Klong Khru Road, Na Di Subdistrict, Mueang District, Samut Sakhon 74000; Tel: 034 419 888 ext. 189

KF Foods Limited No. 1, Moo 4, Ban Plai Klong Khru Road, Na Di Subdistrict, Mueang District, Samut Sakhon 74000; Tel: 034 417 444 ext. 613

Data Protection Officer

Kingfisher Holdings, Ltd. No. 1, Moo 4, Ban Plai Klong Khru Road, Na Di Subdistrict, Mueang District, Samut Sakhon 74000; Tel: 034 419 888 ext. 202

E-mail Address: DPO@kingfisher.co.th

I, ……………………., the data subject, as an Applicant have read and acknowledged the above information and I consent for the Company to process, use, and/or disclose my personal data according to this consent letter to the collection, processing, and/or disclosure of personal data. I hereby enter my signature as evidence.

Sign………………………………………………. Applicant

Date …………………………………………