Privacy Notice
(For Customers of TCP
Group and Other Individuals)
T.C. Pharmaceutical Industries Company Limited and affiliates including Durbell Co., Ltd., T.G. Vending and Showcase Industries Co., Ltd., Hi-Gear Co., Ltd., TC-Trading and Leasing Co., Ltd., Circure Herbal Med Co., Ltd., TCP Incubator Co., Ltd., and Healthven Co., Ltd. (“we”, “us”, or “TCP Group”), as a controller of Personal Data, are subject to Personal Data Protection Act B.E. 2562 (2019) (“PDPA”),is required to comply with PDPA. As a result, the processing of personal data of the individuals by the TCP Group must comply with the requirements set forth in the Personal Data Protection Law including the obligation to notify the data subjects of their legal rights as set out in this notice.
1.
Collection of Personal Data
§ Personal Data provided directly by the data subjects, including through telephone communications, inquiries, complaints notification, use of the company’s website, email, social media platforms, transactions, or participation in activities of TCP Group, face-to-face meeting, on-site visits
§ Personal Data received from affiliates within TCP Group or internal personnels of TCP Group;
§ Personal Data obtained from service providers or vendors of TCP Group, government authorities, or other external organizations;
§ Personal data collected from still images or video footage recorded by the CCTV system under the supervision of the TCP Business Group and
§ Public sources or any other reliable sources.
2.
Types of Personal Data Collected by TCP Group
TCP Group may collect various types of Personal Data depending on purposes of use including the following:
2.1
Generic Personal Data
§
Identification information such as details on ID cards or passports, and copies of such documents, as well as other documents that can be used for identification purposes, such as driver’s licenses, business cards;
§
Full name, address, and other contact information such as phone numbers, email, social media accounts;
§
Information relating to contact information and channels when reaching out to the TCP Group such as social media account names used for communication, the subject of contact, date of visit at TCP Group’s premises or museums, or date of contact through various TCP Group communication channels;
§
Complaint-related information, such as the complaint details, full name, phone number, address, email of the complainant or affected person, complaint date through various channels, including recorded phone conversations;
§
Financial information, such as bank account pages, credit and debit card details, transaction information, payment methods, and other payment details; and
§
Other information such as photographs, date of birth, membership point accumulation.
2.2
Digital and online data, including information on the use of information technology systems
§ Information relating to various access activities such as user logs, including entry/exit systems at TCP Group’s premises or internal areas;
§
IP address;
§
Information collected through cookies or similar technologies;
§
Information related to communications or interactions with TCP Group’s websites;
§ Information obtained from social media and/or other online channels, including comments or inquiries submitted to TCP Group, profile pictures, or other publicly shared information, or data that you have authorized access to in order to link your social media accounts with your membership account;
§
Information from satisfaction surveys and questionnaire responses;
§ Images, video recordings, and audio recordings, including footage from CCTV systems located in the common areas of TCP Group; and
§
Still images, video recordings, and interview content from participation in various activities organized by TCP Group.
3.
Retention Period
TCP Group will retain your Personal Data for as long as it is necessary to fulfill the purposes for which it was collected. The retention period may vary depending on the specific purposes of the data processing or as required by applicable laws. In general, your Personal Data will be kept for a maximum period of 10 years from the date the legal relationship between you and TCP Group ends. However, we may retain your Personal Data for a longer period if permitted by law or if such retention is necessary for the establishment, exercise, or defense of legal claims by TCP Group.
After the expiration of the applicable retention period, TCP Group will delete or destroy your Personal Data from its storage systems and those of third-party service providers (if any) or otherwise anonymize such data so that it can no longer identify you, unless otherwise permitted by applicable laws.
4.
Purposes of Use and Disclosure
TCP Group will use and disclose your Personal Data for the following purposes:
|
Ground of processing |
|
|
Carrying out the sale of products and services of TCP Group, whether through direct sales to retail and wholesale stores, supermarkets, department stores, other operators, sales through TCP Group’s online channels, or sales through third-party marketplaces |
§ Contractual Obligations |
|
Communication, product delivery, and provision of services, including payment confirmation, issuance of invoices, receipts, and tax invoices |
§ Contractual Obligations § Legal Obligations |
|
Registration of customer accounts such as stores, supermarkets, or department stores |
§ Contractual Obligations § Legitimate Interests |
|
Registration and membership on TCP Group’s websites and other online channels |
§ Contractual Obligations § Legitimate Interests § Consent |
|
Communication with customers to present products and services |
§ Legitimate Interests § Consent |
|
Responding to customer feedback or complaints regarding the sale of products and services, and to improve TCP Group’s products and services |
§ Contractual Obligations § Legitimate Interests |
|
Managing membership programs, including point accumulation, redemption, and reward programs |
§ Contractual Obligations |
|
Public relations, advertising, and marketing activities through various media, including social media and other electronic channels, as well as the organisation of events, sports activities, and more |
§ Contractual Obligations § Legitimate Interests § Consent |
|
Organizing lucky draws, prize giveaways, identity verification for participation or prize collection, and TCP Group may use your still images or video footage for advertising and promotional purposes |
§ Contractual Obligations § Legitimate Interests § Consent |
|
Taking photos or video recordings during TCP Group’s events |
§ Legitimate Interests § Consent |
|
Arranging life or accident insurance coverage related to participation in TCP Group’s events |
§ Contractual Obligations § Consent |
|
Collaboration in activities with external organizations, such as EEC Thailand or educational institutions |
§ Contractual Obligations § Legitimate Interests § Consent |
|
Organizing donation events, CSR (Corporate Social Responsibility) activities, or public benefit initiatives held by TCP Group |
§ Legitimate Interests § Consent |
|
Managing visits to TCP Group’s premises, factories, and museums |
§ Legitimate Interests § Consent |
|
Mergers, acquisitions, or organizational restructuring |
§ Contractual Obligations § Legal Obligations § Legitimate Interests § Consent |
|
Reviewing, analyzing, and preparing documents as requested by relevant government authorities |
§ Legal Obligations |
|
Monitoring and resolving issues that may arise with TCP Group’s website or online channels |
§ Legitimate Interests |
|
Compliance with applicable laws |
§ Legal Obligations |
|
Establishing legal claims, litigation, and related proceedings |
§ Legal Obligations |
|
Analyzing, improving, troubleshooting, and developing TCP Group’s products, services, and business processes |
§ Legitimate Interests |
|
Assessing and managing complaints |
§ Contractual Obligations § Legitimate Interests |
|
Managing finance, accounting, and others auditing activities of TCP Group |
§ Legitimate Interests § Legal Obligations |
|
Conducting business that TCP Group deems necessary for lawful purposes, taking into account the fundamental rights of data subjects |
§ Legitimate Interests |
|
Monitoring, maintaining order, and ensuring the safety of individuals, company premises, TCP Group’s assets, and other individuals |
§ Legitimate Interests |
If you are unable to provide the Personal Data required for TCP Group to process based on contractual or legal obligations, TCP Group will be unable to fulfil its contractual obligations with you or comply with its legal obligations. In such circumstances, we may be unable to offer you our products and/or services, or may be unable to engage in transactions with you.
TCP Group will process Personal Data in strict compliance with applicable laws. In cases where TCP Group processes personal data based on consent, data subjects have the right to withdraw their consent at any time.
5. Recipients of Personal Data Disclosed by TCP Group
TCP Group may disclose or transfer your Personal Data under the specified purposes and in accordance with legal requirements to organizations, governmental bodies or third parties including:
§ Individuals or legal entities involved in business transactions of the company such as affiliates of TCP Group both domestically and internationally, joint venture partners, business alliances, in the event of a business sale, merger or acquisition involving any entity in TCP Group, co-marketing activities, assignment, transfer, or other forms of business, asset, or share restructuring involving TCP Group;
§ Vendors or service providers such as contractors, subcontractors, or agents acting on behalf of TCP Group who provide goods or services to TCP Group, event organizers, media and advertising service providers, travel booking providers, various suppliers of raw materials, production equipment, and workplace-related assets;
§ Advisors such as legal advisors, financial advisors, auditors, bankers, and other professionals, both local and international;
§ Governmental and regulatory bodies such as Revenue Department, Department of Provincial Administration, Department of Business Development, Department of Intellectual Property, Department of Foreign Trade, Personal Data Protection Committee, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, courts, the Legal Execution Department, and etc;
§ Other data controller to whom you allow to disclose or transfer data; and
§ Reference persons as provided by the data subject such as applications to participate in TCP Group’s activities.
When disclosing your Personal Data, TCP Group will take appropriate measures to protect it and will comply with the standards and obligations set out in the PDPA. If TCP Group sends or transfers your Personal Data to the recipient outside of Thailand, we will ensure that the destination country, international organisation, or overseas recipient has adequate data protection standards, or that the transfer otherwise complies with the requirements of the PDPA. In certain cases, we may seek your consent for such overseas transfers of your Personal Data.
6. Personal Data Security Measure
TCP Group employs a high-standard security system, both technologically and procedurally, to prevent any potential data theft. The Group has made significant investments in technology, time, and human resources ensuring that TCP Group maintains high-security standards in compliance with ISO/IEC 27001 Your Personal Data remains secure within TCP Group’s security systems to maintain confidentiality and prevent any unauthorized or unlawful loss, access, destruction, use, alteration, modification, or disclosure of your Personal Data.
TCP Group makes an effort to protect Personal Data through technical mechanisms and management by our personnel to control access and safeguard personal data against unauthorized access. However, absolute protection against all risks cannot be guaranteed, such as Protecting personal data from a virus threat or unauthorised access. Data subjects are therefore advised to stay informed about technological developments and to install personal firewall software to help protect their computers from threats or data theft.
7. Right of Data Subject
In exercising any right under Clause 7, data subject shall comply with criteria and procedures
established for data subjects, specified in Clause 8 of this notice. However, the rights specified in this Clause are subject to change as the relevant law may be amended from time to time by the government. TCP Group will inform you about the changes.
7.1 Right to be notified: if TCP Group
collect, store, use or disclose your Personal Data in any manner beyond the intended purposes or your given consent, TCP Group
will notify and/or seek your prior consent with respect to such additional
scope.
7.2 Right to Access to your
Personal Data: You may request for a copy of your Personal
Data and request to disclose about the source of your Personal Data.
7.3 Rectification of the Personal Data: In the event of any changes to personal data of the data subject, the
data subject may submit a request for correction in accordance with the
procedures specified in Clause 7, ensuring that the personal data remains
accurate, up-to-date, complete, and free from misleading.
7.4 Right to data portability: In case where it is technically available, you may request to receive
your Personal Data in a commonly used or readable by the automatic device or to
automatically transfer.
7.5 Right to erasure of your Personal Data: You may request to erase
or make your Personal Data pseudonymized under any of the following
circumstances: (a) your Personal Data is no longer needed to be collected,
stored, used or disclosed for the intended purposes, (b) you withdraw your
consent for your Personal Data to be collected, stored, used or disclosed and
TCP Group no longer has any legal right to process your Personal Data for the
intended purposes, (c) you object to TCP Group’s processing of your Personal
Data, or (d) your Personal Data was processed in contravention of the PDPA.
7.6 Request to suspend the use of your
Personal Data: You may request TCP Group to suspend the use
of your Personal Data in any of the following events:
(1) when TCP Group is in the process of verifying
certain information for the purpose of rectifying, updating, completing or
avoiding any misleading about your Personal Data upon your request;
(2) when your Personal Data is to be erased under
Clause 7.5 but you instead request to suspend its use;
(3) when it is no longer necessary to store your
Personal Data, but you request TCP Group to continue the storage of your
Personal Data for establishing legal claims, legal compliance, exercise of
legal rights or defenses; or
(4) when TCP Group is in the process of verifying its legitimate rights in its data collection or processing for purposes specified by law.
7.7 Right
to object the processing of Personal Data: You may object to the collection,
storage, use or disclosure of your Personal Data in any of the
following events:
(1) In case where your Personal Data was collected
by TCP Group for the purpose of (a) TCP Group’s compliance with a governmental
order or (b) any legitimate interest
of TCP Group or other legal entity;
(2) In case where TCP Group has processed your
Personal Data for the purpose of direct marketing; and
(3) In case where TCP Group has processed your
Personal Data for any research purposes as specified in relevant laws,
including for statistical purpose.
7.8 Right to withdraw consent: You may withdraw your consent at any time. Your withdrawal will not have any effect on TCP Group’s previous data processing. If your withdrawal will affect any part of your Personal Data, TCP Group will notify you of such effect at the time you make such withdrawal.
If you have any questions regarding TCP Group’s practices in processing your Personal Data, please contact TCP Group via the contact channels provided in Section 9. In the event that you have reasonable grounds to believe that TCP Group has breached the PDPA, you have the right to file a complaint with the Office of the Personal Data Protection Committee in accordance with the procedures and requirements set out under the PDPA.
8. Criteria and Procedures for Exercising the Data
Subject Rights
|
8.1 |
§
If you wish to exercise your right, please submit your request via TCP Group website:https://privacy.tcp.com/dsr?id=1f0deb2d-1261-43a7-8b61-90acb9905665&t=0 or §
You may contact our Data Protection Officer of TCP Group at the contact information as specified in Section 9.: § Please mark as “Data Subject’s Rights Request” with your first name, last name and contact information. |
|
8.2 |
§
Your request will be sent to TCP Group’s data protection officer for verification of your identity. §
To verify the identity of the individual submitting the request, verification must be conducted via the ThaiD or by submitting relevant documents, including: a copy of a government-issued identification document (e.g., national ID card, driver’s license, or passport), a contactable address, phone number, information related to TCP Group, and details of products you have purchased from TCP Group. You must also attach the Data Subject Rights Request Form available at the link provided in Clause 8.1. In addition, your signature is required on the request form. |
|
8.3 |
§
The data protection officer will consider whether a request can be processed or not such as its legitimate reasons, its negative impact on a third party etc. and whether the PDPA provides for any exemptions. |
|
8.4 |
§
If your request is approved, the data protection officer will proceed and report the result to you without delay via the channel you have specified in your request. |
|
8.5 |
§
If you request is denied, the data protection officer will notify you with a clear explanation for declining your request without delay via the channel you have specified in your request. You may make an appeal to the authority as prescribed by the PDPA which TCP Group will inform you in TCP Group’s notification of such denial. |
Remark:
1. The procedures above will take no more than 30 (thirty) days following the receipt of your request and all supporting documents.
2. The processing of the above request is free of charge. However, if any part of the request incurs a fee, TCP Group will notify you before proceeding.
9.
Contact Channels and
Contact Information
If you have any
questions regarding the exercise of your rights or the consent you have
provided, you may contact:
Data Protection Officer
Address: 288
Ekachai Rd., Khlong Bang Phran Sub-district, Bang Bon District, Bangkok
Telephone: 094-981-1044
Email: DPO@tcp.com
10.
Changes to This Privacy
Notice
TCP Group may amend this notice from time to time to reflect any changes in the processing of your Personal Data or as required by applicable data protection laws or other relevant regulations. TCP Group will inform you of such changes through appropriate channels, including our website.
