Privacy Notice
T.C. Pharmaceutical Industries Company Limited and its affiliates, including Durbell Co., Ltd., T.G. Vending and Showcase Industries Co., Ltd., Hi-Gear Co., Ltd., TC-Trading and Leasing Co., Ltd., Circure Herbal Med Co., Ltd., TCP Incubator Co., Ltd., and Healthven Co., Ltd. (collectively referred as “we” or “TCP Group”) as a controller of Personal Data, has the duties to comply with the Personal Data Protection B.E. 2562 (2019) (“PDPA”) Consequently, the processing of an individual’s Personal Data by TCP Group is required to comply with PDPA, including the notification of the data subjects as set out in this notice.
1. Collection of Personal Data of the data subjects
TCP Group may collect Personal Data both directly and indirectly from the data subject, their representative, or any person related to the data subject, as provided to the TCP Group as per the following details:
| Types of Data Subjects | Details | Source of Personal Data |
|---|---|---|
| Customers | Individuals who have purchased products and/or used services of TCP Group, or individuals who may purchase and/or use such products or services, as well as other similar individuals such as event participants, website users, individuals who contact TCP Group for information for product purchases, or service requests through various channels of TCP Group, including visitors to TCP Group’s premises or museums. They also include individuals who are related to or act as representatives of corporate customers, and individuals whose Personal Data appears in documents relevant to various processes. For more information, please refer to the Privacy Notice (for Customers of TCP Group). |
|
| External Service Providers and Vendors | Individuals from which TCP Group has made procurement, or individuals who submit bids to sell goods and/or provide services to TCP Group, or those having any other similar relationships to TCP Group such as external service providers, vendors, suppliers, consultants, experts, academics, government officials, participants in TCP Group’s events, meetings, or seminars, or other similar persons. This also includes individuals related to or representing external service providers or vendors who are juristic persons, and those whose Personal Data appear in documents related to the relevant processes. For more information, please refer to the Privacy Notice (for Service Providers and Vendors of TCP Group). |
|
| Job Applicants | Individuals who may be selected as personnel or interns of the TCP Group, who may collect Personal Data of job applicants directly or obtain it from third-party service providers or online recruitment channels, etc. For more information, please refer to the Privacy Notice (for personnel of TCP Group) |
|
| Other individuals | Any other individuals not classified under the aforementioned types, but whose Personal Data is processed by the TCP Group, whether obtained directly through various contact channels of the TCP Group, in-person contact, data collection via website usage through cookies or other technologies, or obtained from third parties such as individuals captured on CCTV and visitors to the TCP Group’s websites. |
|
In certain cases, the TCP Group may automatically collect your Personal Data through various channels such as the use of cookies or other similar technologies. For more information, please refer to the TCP Group’s Cookies Policy.
2. Types of Personal Data Collected by TCP Group
TCP Group may collect various types of Personal Data considering the purposes of use, including the collection of the following Data:
2.1 Generic Personal Data of job applicants, customers, external service providers and vendors, and other individuals
- Personal Identification information such as details on ID cards or passports, and copies of such documents, as well as other documents that can be used for identification purposes such as driver’s licenses, vehicle registration, business cards.
- Name, family name, address, and other contact information such as phone numbers, email, social media accounts;
- Information of affiliated department, branch, division, and position;
- Information relating to communication with TCP Group such as social media account names used for communication, the subject of contact, date of communication or visit at TCP Group’s premises or museums, or date of communication through various TCP Group’s communication channels;
- Complaint-related information such as the subject of the complaint, name and family name, phone number, address, email of the complainant or affected person, complaint date through various channels, including recorded phone conversations;
- Financial information such as bank account pages, credit and debit card details, transaction information, payment methods, and other payment details;
- Other information such as photographs, date of birth, membership point accumulation;
- Name and family name of company’s directors appearing on certified copies of company registration documents and other official documents (if any); and
- Name, family name, address, and phone number appearing on power of attorney documents, including copies of ID cards of the grantor and the authorised person.
2.2 Personal Data relating to job application and internship
- General information such as gender, age, nationality, date of birth, marital status, military status, copy of house registration, vehicle registration, employee ID, signature;
- Family information such as names and family names of family members, relationship to the data subject, contact information of such persons, or occupation);
- Emergency contact persons such as family members or other contactable persons, relationship to the data subject, and their phone numbers;
- Job application form;
- Position, job description of the position, work history, personal history, education history, certificates of completion and academic results, language proficiency, computer skills, training records and test results, workplace, working period, curriculum vitae (CV), qualifications, licenses, general interests, membership in professional associations, information provided by the data subject during interviews, references’ information such as name and family name, position, data of job applicants obtained from reference personsม copies of documents verifying salary/pay slips (from previous companies);
- Information concerning internship affiliated institution, period of internship, name and family name of coordinators and approving persons relating to the internship of each institution.;
2.3 Digital and online data, including information on the use of information technology systems
- Information relating to various access activities such as user logs and data access control systems, including entry/exit systems at TCP Group’s premises or internal areas;
- IP Address
- Information collected through cookies or similar technologies;
- Information related to communications or interactions with TCP Group’s websites;
- Information obtained from social media and/or other online channels, including comments or claims submitted to TCP Group, profile pictures, or other publicly shared information, or data that you have authorised access to in order to link your social media accounts with your membership account;
- Information from satisfaction surveys and questionnaire responses;
- Images, video recordings, and audio recordings, including image recording from CCTV systems located in the common areas of TCP Group;
- Images, video recordings, and interview content from participation in various activities organised by TCP Group.
2.4 2Sensitive Personal Data
- Health information including information relating to physical condition, health including:
- Weight and height;
- Medical certificates;
- Chronic diseases;
- Drug allergy history;
- Religion information;
- Disability information; and
- Criminal records check result.
3. Retention Period
TCP Group will retain your Personal Data for as long as it is necessary to fulfill the purposes for which it was collected. The retention period may vary depending on the specific purposes of the data processing or as required by applicable laws. In general, the maximum period of data retention is 10 years from the date the legal relationship between you and TCP Group ends. However, we may retain your Personal Data for a longer period than such period if permitted by law or if such retention is necessary for the establishment of legal claims by TCP Group.
After the expiration of the above retention period, TCP Group will delete or destroy such data from its storage space or systems of TCP Group and those of other service providers of TCP Group (if any) or anonymize your personal data so that it can no longer identify you, except the case that TCP Group can continue to retain such personal data as prescribed by law.
4. Purposes of Use and Disclosure of Personal Data
TCP Group will use and disclose your Personal Data as follows:
| Purpose of Processing | Lawful basis of processing of Personal data |
|---|---|
| 4.1 Purposes related to the sale of products and the provision of services to customers | |
| To carry out the sale of products and provision of services of TCP Group, whether through direct sales to retail and wholesale stores, supermarkets, department stores, other operators, sales through TCP Group’s online channels, or sales through third-party marketplaces |
|
| For the benefit of Communication, product delivery or provision of services, payment confirmation, issuance of invoices, receipts, and tax invoices |
|
| To register customer accounts for the types of stores, supermarkets, or department stores |
|
| For the benefit of Registration and application for membership on TCP Group’s websites and other online channels |
|
| To communicate with customers to present products and services |
|
| To respond customers’ feedback or complaints regarding the sale of products and provision of services, and to improve TCP Group’s sale of products and provision of services |
|
| To manage membership programs, point accumulation, redemption, and reward programs |
|
| For the benefit of Public relations, advertising, and marketing activities through various media, including social media and other electronic channels, as well as the organisation of events, sports activities, and more |
|
| To organize activities regarding prize giveaways, lucky draws, identity verification for participation in activities or prize collection, and TCP Group may use your images or video footage for advertising and promotional purposes |
|
| To take image or video recordings in various activity events of TCP Group |
|
| To obtain life or accident insurance coverage in the arrangement of activities of TCP Group |
|
| To jointly arrange activities with external organizations such as EEC Thailand or educational institutions |
|
| To arrange donation activities,(Corporate Social Responsibility activities, or public benefit activities by TCP Group |
|
| To manage the communication for visits to TCP Group’s premises, factories, and museums |
|
| 4.2 Purposes related to procurement with service providers and vendors | |
| To carry out the procurement |
|
| To carry out the Procurement of raw materials and various materials and equipment used in product manufacturing |
|
| To inspect, select, and evaluate the qualifications of external service providers or vendors |
|
| To register Vendors (Approved Vendor List: AVL) |
|
| To communicate with external service providers or vendors |
|
| To process payments and receipts of payment |
|
| To inspect the quality of procured goods and services and recommend improvements |
|
| To manage the overseas working of the personnel of the company |
|
| To evaluate the procurement performance |
|
| To carry out the engagement of contact manufacturing |
|
| To organize meetings, seminars, business networking development events (networking) of TCP Group, and to invite relevant parties to participate in such events |
|
| 4.3 Purposes related to job applications | |
| To consider job applications, internship applications, interview and to carry out any related to the job applications, including to evaluate the qualifications of temporally employees (outsource) |
|
| For the purpose of complying with laws related to human resource management and lawful orders of government and relevant authorities such as submitting Data of personnel or award recipient to law enforcement bodies. |
|
| To manage training, evaluation and certification of internship |
|
| 4.4 Other Purposes | |
| For acquisitions of business or merger of business or organisational restructuring |
|
| To inspect, analyse and prepare documents as requested by relevant government authorities |
|
| To inspect and resolve problems that may arise with TCP Group’s website or online channels |
|
| To assess and manage complaints |
|
| To comply with applicable laws |
|
| To establish legal claims, litigation, and other related actions |
|
| To analyse improve, troubleshoot and develop TCP Group’s products and services and to carry out other related actions |
|
| To administer and manage finance, accounting, and others auditing activities of TCP Group |
|
| To conduct businesses that TCP Group deems necessary for lawful purposes, taking into account the fundamental rights of data subjects |
|
| To inspect and maintain order and safety of individuals, premises and properties of TCP Group and other individuals |
|
| To confirm the safety of premises and properties of TCP Group and personal properties of personnel of TCP Group via CCTV |
|
| To monitor the use of narcotics of individuals entering the company premises to prevent accidents and crimes related to the use of narcotics |
|
If the data subject is unable to provide the Personal Data, which is necessary for the processing of personal data to comply with the contractual obligations or to comply with laws, TCP Group will be unable to comply with the contract with such data subject or unable to comply with the laws.
TCP Group will process personal data in strict compliance with applicable laws. In cases TCP Group has obtained consent from the data subject, the data subject may withdraw their consent at any time.
5.The Recipient of the Disclosure of personal data from TCP Group
TCP Group may disclose or transfer your Personal Data under the specified purposes and in accordance with legal requirements to governmental organisations, governmental agencies, or third parties including:
- Individuals or legal entities involved in business operation of the company such as affiliates of TCP Group both domestically and internationally, incorporated joint venture, jointly invested companies, business partners, offer to sell business or merger with any company in TCP Group, co promotion, delegation, transfer, or management in any form of business, properties, or share of TCP Group;
- Vendors or external service providers such as contractors, sub-contractors, or agents acting on behalf of TCP Group who provide goods or services to TCP Group, marketing activities service providers, , advertising media production service providers, air ticket booking service providers, various materials and equipment used for the manufacturing of goods, equipment and properties used in the operational premises of TCP Group, insurance companies, insurance agents or brokers, banks, securities companies, or other financial institutions, hospitals and medical or healthcare professionals, logistics and transportation service providers, market and product research service providers, data analytics service providers, etc.;
- Provision of Information technology system and supporting systems such as data storage service providers and payment service providers;
- Advisors such as legal advisors, financial advisors, auditors, bankers, and other professionals, both local and international;
- Governmental and regulatory bodies such as Revenue Department, Department of Labour Protection and Welfare, Department of Skill Development, Department of Empowerment of Persons with Disabilities, Social Security Office, Department of Provincial Administration, National Statistical Office, Department of Business Development, Department of Intellectual Property, Department of Foreign Trade, the Office of the Personal Data Protection Committee, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, courts, the Legal Execution Department, etc.;
- Other data controller to whom the data subject sends or transfer data;
- Reference persons as provided by the data subject such as referees in job applications or reference person in applications to participate in activities hosted by TCP Group.
Disclosure of your Personal Data to other persons will be made for the purposes as specified, or for other purposes permitted by law. Where the law requires your consent, TCP Group will obtain your consent in advance.
In disclosing your Personal Data, TCP Group will take appropriate measures to protect the disclosed Personal Data and will comply with the standards and obligations for the protection of Personal Data as prescribed by the PDPA. Provided in case that TCP Group sends or transfers your Personal Data to the recipient in foreign country, TCP Group will ensure that the destination country, international organisation, or overseas recipient has adequate data protection standards, or will ensure that the transfer of your Personal Data to foreign country complies with the requirements of the PDPA. In certain cases, we may seek your consent for such sending or transfer of your Personal Data to such foreign country.
6. Data Security Measure
TCP Group employs a high-standard security system, both technologically and procedurally, to prevent any potential data theft. TCP Group has made significant investments, dedication of time and human resources to ensure that TCP has maintained the high standard under ISO/IEC 27001 standard. The Data of personal subject will be secured with TCP Group’s computer systems, which are protected through various measures of TCP Group to maintain confidentiality of your personal data and to prevent any unauthorised or unlawful loss, access, destruction, use, alteration, modification, or disclosure of your Personal Data.
TCP Group has dedicated and made efforts to take care of the security of Personal Data by using technical tools and administration and management by our personnel to control and maintain the security of data to prevent unauthorised access of personal data or confidential data of data subject. However, this may not be able to prevent the failure in every circumstance , such as the prevention of data of the data subject from an attack by computer virus or is accessed by an unauthorised person, thus the Data subjects should always follow updated computer-related information and install personal firewall software to protect computers from threats or data theft./p>
7. Right of Data Subject
The exercise of any right under Clause 7 shall be in compliance with the criteria and procedures for the exercise of right of data subject as specified in Clause 8 of this notice. However, the rights specified in this Clause are subject to change to comply with the criteria to be prescribed by law, which may issue criteria by governmental agencies from time to time and TCP Group will inform the data subject accordingly.
7.1 Right to be notified
if TCP Group wishes to collect, store, use or disclose your Personal Data which is not in accordance with the purposes or is beyond the given consent, TCP Group will notify and/or seek your prior consent before processing the personal data which is beyond such purposes.
7.2 Right to Access to Personal Data
the Data Subject has the right torequest for a copy of your Personal Data and has the right to request the disclosure of the source of thel Data of the data subject.
7.3 Right to Rectification of the Personal Data
In case the personal data of the data subject is changed, the data subject will proceed to file a request to amend such data in accordance with the procedures under clause 7 to make the Personal Data accurate, up-to-date, complete and not misleading.
7.4 Right to data portability
In case where it is technically available, the data subject has the right to receive his/her Personal Data in a commonly used or readable by the automatic device or to request an automatic transfer.
7.5 Right to erasure of your Personal Data
the data subject has the right to erase or destroy or to make the Personal Data pseudonymised under any of the following circumstances: (a) It is no longer necessary to collect, store, use or disclose the personal data for the intended purposes, (b) the data subject withdraws the consent for the collecting, storing, using or disclosing or the personal data and TCP Group no longer has any legal right to process such Personal Data, (c) the data subject objects the processing of your Personal Data, or (d) the Personal Data was processed unlawfully under PDPA.
7.6 Right to Request to suspend the use of Personal Data
the data subject has the right to request TCP Group to suspend its use of your Personal Data in any of the following events:
- (1) when TCP Group is in the process of verifying the Data as requested by the data subject for the purpose of rectifying, updating, completing and not causing the misleading;
- (2) when the Personal Data must be erased or destroyed under Clause 7.5 but the data subject instead requests to suspend the use of data;
- (3) when the data subject is no longer necessary to be stored, but the data subject requests TCP Group to continue the storage of your Personal Data for establishing legal claims, legal compliance, exercise of legal rights or defenses; or
- (4) when TCP Group is in the process of verifying the collection of personal data or is in the process of verifying the processing of personal data for the purposes specified by law.
7.7 Right to object the processing of Personal Data
the data subject has the right to object to the collection, storage, use or disclosure of his/her Personal Data in any of the following events
- (1) Is the data that TCP Group has collected such data (a) from the performance of duties of TCP Group for a governmental order or (b) from the necessity for any legitimate interest of TCP Group or other legal entities;
- (2) In case where TCP Group has processed Personal Data for the purpose of direct marketing; and
- (3) In case where TCP Group has processed Personal Data for any research purposes as specified by laws, including for statistics.
7.8 Right to withdraw consent
the data subject has the right to withdraw consent at any time. Such withdrawal will not have any effect on any processing of personal data that the data subject had previously given the consents. Provided if any withdrawal of consent will have any affect on the Personal Data in any manner, TCP Group will notify the data subject of such effect from the withdrawal of the consent.
However, TCP Group may deny an above request to exercise the right if any action is made for the purpose of, or for complying with, applicable law or court order, or in the case that may have an effect and cause harm to the rights and freedom of the data subject or other persons or it is an action for statistical study and research that has appropriate protection for Personal Data, or for establishing legal claims, legal compliance, exercise of legal rights or defenses.
If you have any concern or questions regarding TCP Group’s practices in processing your Personal Data, please contact TCP Group via the contact channels provided in Section 8. In case there is a e reasonable ground to believe that TCP Group has breached PDPA, you have the right to file a complaint with the Office of the Personal Data Protection Committee in accordance with the procedures and requirements set out under PDPA.
8. Contact Channels and Contact Address
In case the data subject has any questions regarding the exercise of your rights or the consent that the data subject has provided, you may contact:
Data Protection Officer
Address: 288 Ekachai Road., Khlong Bang Phran Sub-district, Bang Bon District, Bangkok
Telephone: 094-981-1044
Email: DPO@tcp.com
Furthermore, if you wish to exercise your rights as a data subject, please submit your request via our website at: https://privacy.tcp.com/dsr?id=1f0deb2d-1261-43a7-8b61-90acb9905665&t=0 or contact our Data Protection Officer of TCP Group through the contact channels provided above. Please specify in your request: “Data Subject Rights Request” and include your full name, surname, and contact information for further correspondence.
9. Changes to This Notice
TCP Group may amend this privacy notice from time to time to reflect any changes in the processing of your Personal Data and as prescribed by PDPA or other relevant laws. TCP Group will inform you of such changes through appropriate channels, including in the website of TCP Group.
