Privacy Notice
(For External Service Providers and Vendors of TCP Group)
T.C. Pharmaceutical Industries Company Limited and its affiliates,
including Durbell Co., Ltd., T.G. Vending and Showcase Industries Co., Ltd.,
Hi-Gear Co., Ltd., TC-Trading and Leasing Co., Ltd., Circure Herbal Med Co.,
Ltd., TCP Incubator Co., Ltd., and Healthven Co., Ltd. (collectively referred
as “we”, “us”, or “TCP Group”), as a controller of
Personal Data, has the duties to comply with the Personal Data Protection Act B.E. 2562
(2019) (“PDPA ”). Consequently, the processing of an individual’s Personal Databy TCP Group is required to comply with PDPA,
including the notification of the data subjects of their legal rights as set
out in this notice.
1.
Collection of Personal
Data of the data subjects
TCP Group may collect Personal Data both
directly and indirectly from the data subject, their representative, or any
person related to the data subject, as provided to the TCP Group as per the
following details:
§ Personal Data provided
by the data subjects to TCP Group;
§ Personal Data obtained
from representatives or internal employees of service providers or vendors who
are juristic persons;
§ Personal Data received
from affiliates within TCP Group or personnels of TCP Group and
§ Public sources or any other reliable sources.
2.
Types of Personal Data
Collected by TCP Group
We may collect various types of Personal Data depending on
purposes of use including the collection of data as follows:
2.1
Generic Personal Data
§
Personal Identification information such as
details on ID cards or passports, and copies of such documents, as well as
other documents that can be used for identification purposes such as driver’s
licenses, vehicle registration, business cards.
§
Name, family name, address, and other contact
information such as phone numbers, email, social media accounts;
§ Information of affiliated department, branch, division, and position;
§ Information relating to communication with TCP Group such as social
media account names used for communication, the subject of contact, date of
communication or visit at TCP Group’s
premises, or date of communication through TCP Group’s various communication
channels;
§
Financial information such as bank account
pages, credit and debit card details, transaction information, payment methods,
and other payment details;
§
Name and family name of company’s directors
appearing on certified copies of company registration documents and other
official documents (if any);
§ Name, family name, address, and phone number appearing on power of attorney documents, including copies of ID cards of the grantor and the authorized person
2.2
Digital and online data, including information on the use
of information technology systems
§
Information relating to various access
activities such as entry/exit systems at TCP Group’s premises or internal
areas;
§
Information related to communications or
interactions with TCP Group’s websites
§ Image recording from CCTV systems located in the common areas of TCP Group;
2.3
Sensitive Personal Data
§
Health
information such as drug test results and medical
certificates;
§
Criminal records check result.
3.
Retention Period
TCP Group
will retain your Personal Data for as long as it is necessary to fulfill the
purposes specified in the processing of such personal data. The retention
period may vary depending on the specific purposes of the data processing or as
required by applicable laws. In general, the maximum
period of data retention is 10 years from the date the legal relationship
between you and TCP Group ends. However, we may retain your Personal Data for a
longer period than such period if permitted by law or if such retention is
necessary for the establishment of legal claims of TCP Group.
After the
expiration of the above retention period, TCP Group will delete or destroy such
data from its storage space or systems of TCP Group and those of other service
providers of TCP Group (if any) or anonymize your personal data so that it can no longer
identify you, except the case that TCP Group can continue to retain such
personal data as prescribed by law.
4. Purposes of Use and
Disclosure of personal data
TCP
Group will use and disclose your Personal Data for the following
purposes:
|
Ground
of processing |
|
|
To carry the
procurement |
§ Contractual Obligations |
|
To carry out the procurement
of raw materials and various materials and equipment used in product
manufacturing |
§ Contractual Obligations |
|
To inspect, select
and evaluate the qualification of external service providers or vendors |
§ Contractual Obligations |
|
To register Vendors
(Approved Vendor List: AVL) |
§ Contractual Obligations § Legitimate Interests |
|
To communicate with external
service providers or vendors |
§ Contractual Obligations § Legitimate Interests |
|
To process payments
and receipts of payment |
§ Contractual Obligations |
|
To inspect the quality
of procured goods and services and recommend improvements |
§ Contractual Obligations § Legitimate Interests |
|
To manage the
overseas working of the personnel of the company |
§ Contractual Obligations |
|
To evaluate the
procurement performance |
§ Legitimate Interests |
|
To carry out
engagement of contact manufacturing |
§ Contractual Obligations |
|
To organize
meetings, seminars, business networking development events (networking) of
TCP Group, and to invite relevant parties to participate in such event
|
§ Legitimate Interests § Consent |
|
Other purposes For acquisitions of
business or merger of business or organisational restructuring |
§ Contractual
Obligations § Legal Obligations § Legitimate Interests § Consent |
|
To inspect, analyse
and prepare documents as requested by relevant government authorities |
§ Legal Obligations |
|
To assess and manage
complaints |
§ Contractual
Obligations § Legitimate Interests |
|
To comply with
applicable laws |
§ Legal Obligations |
|
To establish legal claims, litigation, and other related
actions |
§ Legal Obligations |
|
To analyse, improve,
troubleshoot and develop TCP Group’s
products and services and to carry out other related action |
§ Legitimate Interests |
|
To administer and
manage finance, accounting, and others auditing activities of TCP Group |
§ Legitimate Interests § Legal Obligations |
|
To conduct businesses
that TCP Group deems necessary for lawful purposes, taking into account the
fundamental rights of data subjects |
§ Legitimate Interests |
|
To inspect and
maintain order and safety of individuals, premises and properties of TCP and
other individuals |
§ Legitimate Interests |
|
To monitor the use of narcotics of individuals entering the company premises to
prevent accidents and crimes related to the use of narcotics
|
§ Legitimate Interests § Consent |
If the data subject is
unable to provide the Personal Data, which is necessary for the processing of
personal data to comply with the contractual obligations or to comply with
laws, TCP Group will be unable to comply
with the contract with such data subject or unable to comply with the laws.
TCP Group will process Personal
Data in strict compliance with applicable laws. Where you have provided consent
for any data processing activity, you may withdraw your consent at any time.
5.
The Recipient of the Disclosure
of personal data from TCP Group
TCP Group may
disclose or transfer your Personal Data under the specified purposes and in
accordance with legal requirements to governmental organisations, governmental
agencies, or third parties including:
§
Individuals
or legal entities involved in business operation of the company such as
affiliates of TCP Group both domestically and internationally, incorporated
joint venture, jointly invested companies, business partners, offer to sell
business or merger with any company in TCP Group, co promotion, delegation,
transfer, or management in any form of business, properties, or share ofTCP
Group;
§
Advisors
such as legal advisors, financial advisors, auditors, bankers, and other
professionals, both local and international;
§
Governmental
and regulatory bodies such as Revenue Department, Department of Provincial
Administration, Department of Business Development, Department of Intellectual
Property, Department of Foreign Trade, the Office of the Personal Data
Protection Committee, Office of Trade Competition Commission, Royal Thai
Police, Office of the Attorney General, courts, the Legal Execution Department,
etc.;
§
Other
data controller to whom the data subject sends or transfer data;
Disclosure of your Personal Data to other persons will be made for the purposes as specified, or for other
purposes permitted by law. Where the law requires your consent, TCP Group will
obtain your consent in advance.
In
disclosing your Personal Data, TCP Group will take appropriate
measures to protect the disclosed Personal Data and will comply with the
standards and obligations for the protection of Personal Data as prescribed
by the PDPA Act. Provided in case that
TCP Group sends or transfers your Personal Data to the recipient in
foreign country, TCP Group will ensure that the destination country,
international organization, or overseas recipient has adequate data protection
standards, or will ensure that the transfer of your Personal Data to foreign
country complies with the requirements of the PDPA Act. In certain cases, we
may seek your consent for such sending or transfer of your Personal Data to such foreign country.
6. Data Security Measure
TCP Group employs a high-standard security
system, both technologically and procedurally, to prevent any potential data
theft. TCP Group has made significant investments, dedication of time and human
resources to ensure that TCP has maintained the high standard under ISO/IEC
27001 standard. The Data of personal
subject will be secured with TCP Group’s computer systems, which are protected
through various measures of TCP Group to maintain confidentiality of your personal
data and to prevent any unauthorised or unlawful loss, access, destruction,
use, alteration, modification, or disclosure of your Personal Data.
TCP
Group has dedicated and made efforts to take care of the security of Personal Data by using
technical tools and administration and
management by our personnel to control and maintain the security of data to
prevent unauthorised access of personal
data or confidential data of data subject. However, this may not be able to
prevent the failure in every circumstance , such as the prevention of data of
the data subject from an attack by computer virus or is accessed by an
unauthorised person, thus the Data subjects should always follow updated
computer-related information and install personal firewall software to protect
computers from threats or data theft.
7.
Right of Data Subject
The exercise of any right under Clause 7 shall be in compliance with the criteria and procedures for the exercise of right of data subject as specified in Clause 8 of this notice. However, the rights specified in this Clause 7 are subject to change to comply with the criteria to be prescribed by law, which may issue criteria by governmental agencies from time to time and TCP Group will inform the data subject accordingly.
7.1 Right to be notified: if TCP Group
wishes to collect, store, use or disclose your Personal Data which is not in
accordance with the purposes or is beyond the
given consent, TCP Group will notify and/or seek your prior consent
before processing the personal data which is beyond such purposes.
7.2 Right to
Access to Personal Data: the Data Subject has the right
tor equest for a copy of your Personal Data and has the right to request the
disclosure of the source of thel Data of
the data subject.
7.3 Right to Rectification of
the Personal Data: In case the personal data of the data
subject is changed, the data subject will proceed to file a request to amend
such data in accordance with the procedures under clause 7 to make the
Personal Data accurate, up-to-date, complete and not misleading.
7.4 Right to data portability: In case where it is technically available, the
data subject has the right to receive his/her Personal Data in a commonly used
or readable by the automatic device or to request an automatic transfer.
7.5 Right to erasure of your
Personal Data: the data subject has the right to erase or
destroy or to make the Personal Data pseudonymized under any of the following
circumstances: (a) It is no longer necessary to collect, store, use or disclose
the personal data for the intended purposes, (b) the data subject
withdraws the consent for the
collecting, storing, using or disclosing or the personal data and TCP Group no
longer has any legal right to process such Personal Data, (c) the data subject
objects the processing of your Personal Data, or (d) the Personal Data was
processed unlawfully under the PDPA Act.
7.6 Right to Request to
suspend the use of Personal Data: the data
subject has the right to request TCP Group to suspend its use of your Personal
Data in any of the following events:
(1) when TCP Group is in the process of verifying
the Data as requested by the data subject for the purpose of rectifying,
updating, completing and not causing the
misleading. t;
(2) when the Personal Data must be erased or
destroyed under Clause 7.5 but the data subject instead requests to suspend the
use of data;
(3) when the data subject is no longer necessary
to be stored, but the data subject requests TCP Group to continue the storage
of your Personal Data for establishing legal claims, legal compliance, exercise
of legal rights or defenses; or
(4) when TCP Group is in the process of verifying
the collection of personal data or is in the process of verifying the
processing of personal data for the purposes specified by law.
7.7 Right to object the processing of Personal Data: the data subject has
the right to object to the collection, storage, use or disclosure of his/her Personal
Data in any of the following events:
(1) Is the data that TCP Group has collected such
data (a) from the performance of duties of TCP Group for a governmental order
or (b) from the necessity for any
legitimate interest of TCP Group or other legal entities;
(2) In case where TCP Group has processed Personal
Data for the purpose of direct marketing; and
(3) In case where TCP Group has processed Personal
Data for any research purposes as specified by laws, including for statistics.
7.8 Right to withdraw
consent: the data subject has the right to
withdraw consent at any time. Such
withdrawal will not have any effect on any processing of personal data that the
data subject had previously given the consents. Provided if any withdrawal of
consent will have any affect on the Personal Data in any manner, TCP Group will
notify the data subject of such effect from the withdrawal of the consent.
However, TCP Group may deny an above request to exercise the
right if any action is made for the
purpose of, or for complying with, applicable law or court order, or in the
case that may have an effect and cause harm to the rights and freedom of the
data subject or other persons or it is
an action for statistical study and research that has appropriate protection
for Personal Data, or for establishing legal claims, legal
compliance, exercise of legal rights or defenses.
If you have any
concern or questions regarding TCP Group’s practices in processing your
Personal Data, please contact TCP Group via the contact channels provided in
Section 8. In case there is a e reasonable ground to believe that TCP Group has
breached the PDPA Act, you have the right to file a complaint with the Office
of the Personal Data Protection Committee in accordance with the procedures and
requirements set out under the PDPA.
8
Criteria and Procedures
for Exercise the Rights of data subject
|
8.1 |
§
If the data subject
wishes to exercise the right, please submit the Data Subject Rights Request Form via TCP Group website: https://privacy.tcp.com/dsr?id=1f0deb2d-1261-43a7-8b61-90acb9905665&t=0 or Contact our Data Protection Officer of TCP Group at the contact
information as specified in Section 9.: § Please mark as “Data Subject’s Rights Request” with your
first name, last name and contact information. |
|
8.2 |
§
The request will be sent to TCP Group’s data protection
officer for verification of your identity. §
To verify the identity of the individual submitting the
request, verification must be conducted via the Thai ID or by submitting
relevant documents, including: a copy of a government-issued identification
document (e.g., national ID card, driver’s license, or passport), a
contactable address, phone number, information related to TCP Group, and
details of products you have purchased from TCP Group. You must also attach
the Data Subject Rights Request Form available at the link provided in Clause
8.1. In addition, your signature is required on the request form. |
|
8.3 |
§
The data protection officer will consider whether the
request can be processed such as by considering the reasonableness or
negative effect that may arise on others or whether there is any reason for
denial as prescribed by law. |
|
8.4 |
§
If the request is under the criteria to be processed,
the data protection officer will proceed the Data Subject Rights Request Form
and report you without delay via the contact channel that the data subject
has informed in the Data Subject Rights Request Form. |
|
8.5 |
§
If the request is not under the criteria to be
processed, the data protection officer will notify you without delay via the
contact channel that the data subject has informed in the Data Subject Rights
Request Form with the reason of denial. In this circumstance, the data
subject has the right to file a complaint with a supervising agency as
prescribed by law to be informed for
your information in the notification of
consideration. |
Remark:
1. The action above will take no more than 30 (thirty) days following
the date of receipt of the Data Subject Rights Request Form and all supporting documents.
2. The
action in accordance with the above request will not incur any expenses.
However, if any action in accordance with any request will incur any
expense, TCP Group will notify the data
subject prior to taking any action.
9
Contact Channels and
Contact Address
In case the data subject has any questions regarding the exercise of
your rights or the consent that the data subject has provided, you may contact:
Data Protection Officer
Address: 288
Ekachai Road., Khlong Bang Phran Sub-district, Bang Bon District, Bangkok
Telephone: 094-981-1044
Email: DPO@tcp.com
10
Changes to This Notice
TCP Group may amend this privacy notice from time to time to reflect any changes in the processing of your Personal Data as prescribed by PDPA Act or other relevant laws. TCP Group will inform you of such changes through appropriate channels, including in the website of TCP Group.
