Privacy Notice
(For Job Applicants of TCP Group)
T.C. Pharmaceutical Industries Company Limited and affiliates including Durbell Co., Ltd., T.G. Vending and Showcase Industries Co., Ltd., Hi-Gear Co., Ltd., TC-Trading and Leasing Co., Ltd., Circure Herbal Med Co., Ltd., TCP Incubator Co., Ltd., and Healthven Co., Ltd. (“we”, “us”, or “TCP Group”), as a controller of Personal Data, are subject to Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). is required to comply with PDPA. As a result, the processing of personal data of the individuals by the TCP Group must comply with the requirements set forth in the Personal Data Protection Law, TCP Group is required to comply with PDPA, including the obligation to notify the data subjects of their legal rights as set out in this notice and obtain data subject’s consent (in certain cases).
1.
Collection of Personal Data
TCP Group may collect personal data both directly and indirectly from the data subject, their representative, or any person related to the data subject, as provided to the TCP Group as per the following details:
§ Personal Data provided by the data subjects via job application form and relevant documents, or job interview with TCP Group;
§ Personal Data obtained from representatives, internal employees who are referees of the data subjects, educational institutions, or individuals related to the data subjects;
§ Personal Data obtained from external service providers of the TCP Group such as recruitment agencies, including recruitment via job recruitment websites and social media platforms; and
§ Public sources or any other reliable sources.
2.
Types of Personal Data Collected by TCP Group
TCP Group may collect various types of Personal Data depending on purposes of use including the correction of the following data:
2.1
Generic Personal Data
§
Identification information such as ID cards or passports , and copies of such documents;
§
Full name, address, and other contact information such as phone numbers, email; and
§
Organizational information including department, branch, division, and position.
2.2
Personal Data relating to job applications, and internships
§
General information such as gender, age, nationality, date of birth, age, marital status, military status, signature, and photo;
§
Job application form;
§
Position, job description, work history, personal history, education history, certificates of completion and academic results, language proficiency, computer skills, training records and test results, workplace, working period, curriculum vitae (CV), qualifications, licenses, general interests, membership in professional associations, information provided by the data subject during interviews, references’ information such as name, position, and documents verifying salary or pay slips (from previous employers); and
§
Previous salary and expected salary.
2.3
Digital and online data, including information on the use of information technology systems
§
Images, video recordings, and audio recordings, including footage from CCTV systems located in the common areas of TCP Group.
2.4
Sensitive Personal Data
§ Health information including any medical condition, health problem, sick leave records, including:
o Weight and height; and
o Chronic diseases;
§
Religion;
§
Disability; and
§
Criminal records check result.
3.
Retention Period
TCP Group will retain your Personal Data for as long as it is necessary to fulfill the purposes for which it was collected. The retention period may vary depending on the specific purposes of the data processing or as required by applicable laws. In general, the maximum period data retention is 10 years from the date the legal relationship between you and TCP Group ends. However, we may retain your Personal Data for a longer period than such period if permitted by law or if such retention is necessary for the establishment of legal claims by TCP Group.
After the
expiration of the above retention period, TCP Group will delete or destroy such
Data from its storage systems and those
of third-party service providers (if any) or otherwise anonymize such data so
that it can no longer identify you, except the case that TCP Group can continue
to retain such personal data as prescribed by law.
4.
Purposes of Use and Disclosure of Personal
Data
TCP
Group will use and disclose your Personal Data for the following
purposes:
|
Ground
of processing |
|
|
For the purposes of considering job applications, internship applications, interviews, and any actions related to the application process, including evaluating the qualifications of contracted or outsourced employees |
§ Contractual Obligations § Legitimate Interests § Consent |
|
For the purpose of complying with applicable laws related to human resource management and lawful orders issued from governmental authorities and relevant officers such as submitting Personnel Data or award recipients to competent government agencies.. |
§ Legal Obligations |
|
Assurance of security of TCP Group’s premises and assets, as well as the personal belongings of TCP Group’s employees through closed-circuit television (CCTV) surveillance. |
§ Legitimate Interests |
|
For the purposes of business acquisition, merger, or organizational restructuring. |
§ Contractual Obligations § Legal Obligations § Legitimate Interests § Consent |
|
For the purposes of verification, analysis, and preparation of documents as requested by relevant governmental authorities |
§ Legal Obligations |
|
To comply with applicable laws and regulations |
§ Legal Obligations |
|
For the establishment of legal claims, litigation, and related proceedings |
§ Legal Obligations |
|
For the purpose of monitoring, maintaining order, and ensuring the safety of individuals, company premises, TCP Group’s assets, and other individuals |
§ Legitimate Interests |
TCP Group will process Personal Data in strict compliance with
applicable laws. Where
consent has been obtained from the data subject, the data subject may withdraw
such consent at any time.
5.
Recipients of Personal
Data Disclosed by the TCP Group
TCP Group may disclose or
transfer your Personal Data under the specified purposes and in accordance with
legal requirements to organizations, governmental bodies or third parties
including:
§ Individuals or legal entities involved in business operation of the company such as affiliates of TCP Group both domestically and internationally, incorporated joint venture, jointly invested companies, business partners, offer to sell business or merger with any company in TCP Group, delegation, transfer, management in any form of business, properties, or share of TCP Group;
§ Vendors or external service providers such as contractors, external service providers, or agents acting on behalf of TCP Group, etc.;
§ Information technology and system support providers such as data storage providers;
§ Advisors such as legal advisors, financial advisors, auditors, bankers, and other professionals, both local and international;
§ Governmental and regulatory authorities such as Revenue Department, Department of Labour Protection and Welfare, Department of Skill Development, Department of Empowerment of Persons with Disabilities, Social Security Office, Department of Provincial Administration, Department of Business Development, Department of Intellectual Property, Department of Foreign Trade, Personal Data Protection Committee, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, courts, the Legal Execution Department, etc.;
§ Other Data Controllers to whom you allow to disclose or transfer data; and
§ Reference persons as provided by the data subject such as referees listed in job applications.
In disclosing your Personal Data, TCP Group will take appropriate measures to protect the disclosed Personal Data and will comply with the standards and obligations for the protection of Personal Data as prescribed bythe PDPA. Provided in case that TCP Group sends or transfers your Personal Data to the recipient in foreign country, TCP Group will ensure that the destination country, international organization, or overseas recipient has adequate data protection standards, or will ensure that the transfer of your Personal Data to foreign country complies with the requirements of the PDPA. In certain cases, we may seek your consent for such sending or transfers of your Personal Data to such foreign country..
TCP Group employs a high-standard security system, both technologically and procedurally, to prevent any potential data theft. TCP Group has made significant investments, dedication of time and human resources to ensure that TCP has maintained the high standard under ISO/IEC 27001 standard. The Data of personal subject will be secured with TCP Group’s computer systems, which are protected through various measures of TCP Group to maintain confidentiality of your personal data and to prevent any unauthorised or unlawful loss, access, destruction, use, alteration, modification, or disclosure of your Personal Data.
TCP Group has dedicated and made efforts to take care of the
security of Personal Data
by using technical tools and administration and management by our
personnel to control and maintain the security of data to prevent
unauthorised access of personal data or confidential data of data subject.
However, this may not be able to prevent the failure in every circumstance ,
such as the prevention of data of the data subject from an attack by computer
virus or is accessed by an unauthorized person, thus the Data subjects should
always follow updated computer-related information and install personal
firewall software to protect computers from threats or data theft.
7. Right of Data Subject
The exercise of any right under Clause 7 shall be in compliance with
the criteria and procedures for the exercise of right of data subject as
specified in Clause 8 of this notice. However, the rights
specified in this Clause are subject to
change to comply with the criteria to be prescribed by law, which may issue criteria
by governmental agencies from time to time and TCP Group will inform the data
subject accordingly.
7.1 Right to be notified: if TCP Group wishes to collect, store, use or disclose your Personal
Data which is not in accordance with the purposes or is beyond the given consent, TCP Group will notify and/or
seek your prior consent before processing the personal data which is beyond
such purposes.
7.2 Right to Access to Personal Data: the Data Subject has the right torequest for a
copy of your Personal Data and has the right to request the disclosure of the source of thel Data of the data subject.
7.3 Right to Rectification of
the Personal Data: In case the personal data of the data
subject is changed, the data subject will proceed to file a request to amend
such data in accordance with the procedures under clause 7 to make the
Personal Data accurate, up-to-date, complete and not misleading.
7.4 Right to data portability: In case where it is technically available, the
data subject has the right to receive his/her Personal Data in a commonly used
or readable by the automatic device or to request an automatic transfer.
7.5 Right to erasure of your
Personal Data: the data subject has the right to erase or
destroy or to make the Personal Data pseudonymised under any of the following
circumstances: (a) It is no longer necessary to collect, store, use or disclose
the personal data for the intended purposes, (b) the data subject
withdraws the consent for the
collecting, storing, using or disclosing or the personal data and TCP Group no
longer has any legal right to process such Personal Data, (c) the data subject
objects the processing of your Personal Data, or (d) the Personal Data was
processed unlawfully under the PDPA Act.
7.6 Right to Request to
suspend the use of Personal Data: the data
subject has the right to request TCP Group to suspend its use of your Personal
Data in any of the following events:
(1) when TCP Group is in the process of verifying
the Data as requested by the data subject for the purpose of rectifying,
updating, completing and not causing the
misleading. t;
(2) when the Personal Data must be erased or
destroyed under Clause 7.5 but the data subject instead requests to suspend the
use of data;
(3) when the data subject is no longer necessary
to be stored, but the data subject requests TCP Group to continue the storage
of your Personal Data for establishing legal claims, legal compliance, exercise
of legal rights or defenses; or
(4) when TCP Group is in the process of verifying
the collection of personal data or is in the process of verifying the
processing of personal data for the purposes specified by law.
7.7 Right to object the processing of Personal Data: the data subject has
the right to object to the collection, storage, use or disclosure of his/her Personal
Data in any of the following events:
(1) Is the data that TCP Group has collected such
data (a) from the performance of duties of TCP Group for a governmental order
or (b) from the necessity for any
legitimate interest of TCP Group or other legal entities;
(2) In case where TCP Group has processed Personal
Data for the purpose of direct marketing; and
(3) In case where TCP Group has processed Personal
Data for any research purposes as specified by laws, including for statistics.
7.8 Right to withdraw
consent: the data subject has the right to withdraw
consent at any time. Such withdrawal will not have any effect on any processing
of personal data that the data subject had previously given the consents.
Provided if any withdrawal of consent will have any affect on the Personal Data
in any manner, TCP Group will notify the data subject of such effect from the
withdrawal of the consent.
However, TCP Group may deny an above request to exercise the
right if any action is made for the
purpose of, or for complying with, applicable law or court order, or in the
case that may have an effect and cause harm to the rights and freedom of the
data subject or other persons or it is
an action for statistical study and research that has appropriate protection
for Personal Data, or for establishing legal claims, legal
compliance, exercise of legal rights or defenses.
If you
have any concern or questions regarding TCP Group’s practices in processing
your Personal Data, please contact TCP Group via the contact channels provided
in Section 8.In case there is a e reasonable ground to believe that TCP Group
has breached the PDPA , you have the right to file a complaint with the Office
of the Personal Data Protection Committee in accordance with the procedures and
requirements set out under the PDPA.
8
Criteria and Procedures for Exercise of Your Rights
|
8.1 |
§
If you wish to exercise your right, please submit your request via TCP Group website: https://privacy.tcp.com/dsr?id=1f0deb2d-1261-43a7-8b61-90acb9905665&t=0 or §
You may contact our Data Protection Officer of TCP Group at the contact information as specified in Section 9.: § Please mark as “Data Subject’s Rights Request” with your first name, last name and contact information. |
|
8.2 |
§
Your request will be sent to TCP Group’s data protection officer for verification of your identity. §
To verify the identity of the individual submitting the request, verification must be conducted via the ThaiD or by submitting relevant documents, including: a copy of a government-issued identification document (e.g., national ID card, driver’s license, or passport), a contactable address, phone number, information related to TCP Group, and details of the job application information you have provided to TCP Group. You must also attach the Data Subject Rights Request Form available at the link provided in Clause 8.1. In addition, your signature is required on the request form. |
|
8.3 |
§
The data protection officer will consider whether the request can be processed such as by considering the reasonableness or negative effect that may arise on others or whether there is any reason for denial as prescribed by law. |
|
8.4 |
§
If the request is under the criteria to be processed, the data protection officer will proceed
the Data Subject Rights Request Form and report you without delay via the contact channel that the data subject has informed in the Data Subject Rights Request Form. |
|
8.5 |
§
If the request is not under the criteria to be processed, the data protection officer will notify you without delay via the contact channel that the data subject has informed in the Data Subject Rights Request Form with the reason of denial. In this circumstance, the data subject has the right to file a complaint with a supervising agency as prescribed by law to be informed for your information in the notification of consideration. |
Remark:
1. The action above will take no more than 30 (thirty) days following the date of receipt of the Data Subject Rights Request Form and all supporting documents.
2. The action in accordance with the above request will not incur any expenses. However, if any action in accordance with any request will incur any expense, TCP Group will notify the data subject prior to taking any action.
9 Contact Channels and Contact Information
Data Protection Officer
Address: 288 Ekachai Rd., Khlong Bang Phran Sub-district, Bang Bon District, Bangkok
Telephone: 094-981-1044
Email: DPO@tcp.com
10 Changes to This Privacy Notice
TCP Group may amend this notice from time to time to reflect any changes in the processing of your Personal Data as prescribed by PDPA or other relevant regulations. TCP Group will inform you of such changes through appropriate channels, including in the website of TCP Group.
