การคุ้มครองข้อมูลส่วนบุคคล

1. Introduction

This Privacy Notice is issued by WHA Industrial Development Public Company Limited (the “Company”, “we”, “us”, or “our”), a limited company registered in Thailand.

The Company is committed to protecting and respecting privacy of whom we interact. This Privacy Notice explains what Personal Data we collect, how we use and disclosure it as well as your rights.

This Notice is addressed to individuals outside the Company with whom we are in contact, such as individual clients, visitors to our offices, sites or websites, our suppliers, business partners, representative of our clients, of our partners or of suppliers/other organisations or other individuals (hereinafter “you”). Defined terms used in this Notice are described in Section 2.

This Notice may be updated from time to time to record changes in our Processing of Personal Data or changes in law. We encourage you to read this Notice, and to regularly check for updates.

2. Terms and definitions

No.	Key terms	Definition
1.	Personal Data	Data that is about any individual, or from which any individual is directly or indirectly identifiable, in particular by reference to an identifier (e.g. a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity) which is processed by the Company or by a Data Processor on behalf of the Company.
2.	Sensitive Personal Data	Sensitive Personal Data is a category of Personal Data. It is any Personal Data relating to race, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data or disability condition, trade union information, genetic data, biometric data and any data of the same nature as prescribed by the Personal Data Protection Commission established by the PDPA (“Commission”).
3.	Processing	Any activity with any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, storage, alteration, consultation, use, retrieval, disclosure by transmission, share, making available, alignment or combination, restriction transmission, dissemination, erasure or destruction by any means.
4.	Data Subject	An identified or identifiable natural person to whom the Personal Data is related to.. Data Subject shall not include deceased person and ‘juristic person’ (established under the laws, such as a company, foundation, association or other organisations).
5.	Data Controller	A person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data.
6.	Data Processor	A person or a juristic person who process the Personal Data pursuant to the orders given by, or on behalf of, the Company acting as a Data Controller.
7.	Data Protection Officer	The Data Protection Officer (DPO) appointed by the Company.
8.	Personal Data Breach	Any unlawful or unauthorised Processing of the Personal Data

3. Personal Data that the Company Processes

Personal Data In the course of our business, we may obtain and process your Personal Data as our clients, partners, suppliers, or when you are in contact with us, e.g. when you participate in the Company’s events, job application process, etc. Some data we obtain are Personal Data about you.

4. Methods/ sources that the Company use to collect your Personal Data

Personal Data In the course of our business, we may obtain and process your Personal Data as our clients, partners, suppliers, or when you are in contact with us, e.g. when you participate in the Company’s events, job application process, etc. Some data we obtain are Personal Data about you.

5. Purposes of Processing of Personal Data

Personal Data In the course of our business, we may obtain and process your Personal Data as our clients, partners, suppliers, or when you are in contact with us, e.g. when you participate in the Company’s events, job application process, etc. Some data we obtain are Personal Data about you.

6. Sharing/Transfer of Personal Data within the country

We share or transfer Personal Data when:

The Company will ensure that the organisations that we may share Personal Data about you have an adequate data protection standard.

In light of the above, the Company may, in the ordinary course of our business, disclose or share the Personal Data we collect with the following persons for the following purposes:

7. International Transfer Of Personal Data

Because of our nature of business and for the purposes as specified in items 5-6, we may send, transfer, share or transmit Personal Data about you to persons in other countries when such transfer, sharing or transmitting has a valid legal base as specified in item 6 and provided further that: the recipient of the Personal Data has sufficient safeguard for data in accordance with the notification of the Commission. We may share or transfer the Personal Data even if there is no sufficient safeguard in the foreign country only when:

the transfer or sharing is necessary to comply with the law;
we obtain an explicit consent from you to the transfer/sharing by you being fully informed of the details of such inadequacy of safeguard of that other country;
it is necessary for the purpose of contracting or proceeding with a matter upon your request prior to contracting;
it is necessary for the performance of a contract between the Company and another individual or juristic person for your benefit;
it is necessary for prevention or suppression of a danger to life, body or health or other substantial public interest;
It is necessary for carrying out activities relating to one or more significant public interest as permitted by law;
When the transfer or sharing is required, or permitted, by the law

We may also transfer or share the Personal Data to our subsidiary or affiliate abroad in accordance with the law for the above purposes as specified in this Privacy Policy (See items 5-6).

8. Retention Period

The criterion we use for determining the data retention period are as follows: we will retain Personal Data as long as it is necessary to serve or interact with you in accordance with the law and for as long as it is considered to be reasonable according to the purposes for which the Personal Data is collected. In particular, we may retain your Personal Data for the duration of any period necessary to establish, exercise or defend any legal rights.

If you would like to delete your Personal Data, you can make a request to us through different channels such as through the Company’s Website or filling in the form available at our office or by contacting our Call Center at [other channel(s) to be determined by CEO at a later stage] [Monday to Friday from [09.00-17.00 hours] We will consider it on a case-by-case basis.

9. Your rights

You are entitled to the following rights under the PDPA:

No.	Data Subject’s Rights	Description
1.	Right of access	You have a right to get access and obtain a copy of your Personal Data that we hold about you, or you may ask us to disclose the sources of where we obtained your data that you haven’t given consent. We would not be able to provide you with such access if it is prohibited by the law or court order and such access would impair rights and freedom of other persons.
2.	Right to data portability	You have a right to request us to transfer your Personal Data to other persons/organisations, or request to see the Personal Data that we have transferred to other persons/organisations, unless it is impossible due to technical circumstances.
3.	Right to object the Processing of your data	You have a right to object to the Processing of your Personal Data. The Company respects your right and we will assess the request on a case-by-case basis in accordance with the legal requirements.
4.	Right to erasure	You have a right to request us to delete, destroy or anonymise your Personal Data in the following circumstances where: The Personal Data is no longer necessary for the purpose of which it was collected, used or disclosed; You have withdrawn your consent to which the collection, used or disclosure is based on; You have objected to the collection, use or disclosure of the Personal Data and the Company has no ground to reject such request; When the Personal Data has been unlawfully collected, used or disclosed under the PDPA; Any other circumstances as specified by the law. The Company respects your right and we will delete your Personal Data unless the Company consider necessary to maintain such Personal Data.
5.	Right to restrict the Processing of your data	You have a right to request us to restrict the Processing of your Personal Data in the following circumstances when: It is under the pending examination process of checking whether the Personal Data is accurate, up- to-date and complete or not; It is the Personal Data that should destroyed as it does not comply with the law and you request to restrict it instead; The Personal Data is no longer necessary to retain for the purpose of which it was collected, used or disclosed, but you still have the necessity to request the retention for the purposes of the establishment, compliance, exercise of legal claims or the defense of legal claims; The Company is considering your objects the Processing of Personal Data.
6.	Right to withdraw consent	You may withdraw your consent any time, unless it is against the Company’s notice. After the consent is withdrawn, we will stop Processing the Personal Data, unless there are other legal bases on which the Personal Data can be processed by us.
7.	Right to rectification	You have a right to rectify inaccurate Personal Data in order to make it accurate, up-to-date, complete and not misleading. If the Company rejects your request, the Company will record such rejection with reasons.
8.	Right to lodge a complaint	You will have the right to make a complaint in the case of where the Company, the Data Processor including the employees of the Company does not comply with the PDPA or other announcements of the PDPA.

10. Updating your Personal Data

In the event that the Personal Data you have provided has changed, we encourage you to notify the Company of such update or edit the provided Personal Data so that your Personal Data is accurate and up-to-date. If your Personal Data is incorrect, it may affect the services of the Company and the Company will not be responsible for any loss or damage that may arise with you or the third party as a result of your failure to correct or update your Personal Data to be accurate in any way.

11. Company’s Record of Request/ Refusal

When there is a request to exercise the rights, we will acknowledge receipt of the request and confirm that we’re looking into the request and will respond within the statutory timeframe. We will assess the legal requirements, legal basis of Processing, consequence that the request may result on you and we will respond to you in due course. Each request would be considered in relation to the facts and circumstances and the legal requirements at the time. We will keep track and record the request for accountability purposes.

12. Right to File a Complaint with the Office of Personal

You have the right to make a complaint in the case of where the Company, the Data Processor including the employees of the Company does not comply with the PDPA or other announcements of the PDPA.

If you consider that we have processed your Personal Data in violation of applicable law and failed to remedy such violation to your reasonable satisfaction, please contact the DPO of the Company via DPO.office@wha-group.com at WHA Corporation Public Company Limited.

In addition, you can contact the Company via our Call Center on Monday to Friday from 09.00 – 17.00 hours or at our head office located at WHA Corporation Public Company Limited.

You also have the right to lodge a complaint with the Personal Data Protection Commission or any Expert Committee appointed by it in accordance with the law.

13. Security of your Personal Data

The company certifies that all the Personal Data collected will be stored safely and strictly with adequate security standards. If you have a reason to believe that your Personal Data has been breached or if you have any questions regarding this Privacy Notice, please contact the DPO of the Company.

The company will take appropriate steps to ensure that all Personal Data collected and processed is kept secure and protected against unauthorized or unlawful Processing, use, modification or disclosure, accidental loss or destruction of, or damage by establishing the policies and procedures, and implementing the technologies and software such as user authentication control, external and internal network perimeter controls and malicious program/ software control.

14. Cookies

Subject to obtaining your consent, we may place Cookies on your web browser, your device or read Cookies already on your device when you visit our websites or check for messages.
We may use Cookies to:

distinguish between users;
tailor our websites and services to the needs and preferences of visitors;
improve the use and the functionality of our websites; and
analyse how our website is used and compile anonymous and aggregate statistics

You may choose to disable some of the above cookies while visiting our websites. However, disabling any of such cookies may impact your experience on our websites.
If you use different devices to access our websites, we recommend you ensure that each browser of each device is set to your cookie preference.
For more details on cookie management, please refer to our ‘Cookies policy’.

15. Redirecting to other parties’ websites

The Company’s websites may be redirected to other websites for the purpose of facilitating you when you visit other websites. These websites may collect your Personal Data. The Company is not responsible for the Processing of your Personal Data by other websites or such parties. For this reason, the Company recommends that you carefully review the Privacy Notice of these websites before you use the service on those websites.

16. Changes to the Privacy Notice

The Company reserves the right to change, amend or update the Privacy Notice at any time as it deems appropriate by notifying you of the said change. The Company will notify the changes on the website or via [other channel(s) to be determined by CEO at a later stage] in which you can check at any time.

17. Contact us

If you have any comments, suggestions, questions or want to make a complaint regarding your Personal Data, please contact the DPO of the Company via DPO.office@wha-group.com at WHA Corporation Public Company Limited.