Privacy Policy

Definitions

Personal Data refers to information about an individual that allows for the identification of that individual, directly or indirectly. This does not include data about deceased persons.

Respecting Privacy Rights

The company respects and values the rights, personal data, and protection of personal data, acknowledging that the data owners expect their data to be secure when provided to the company.

Personal data collected by the company, which can identify the data owner and is complete, accurate, current, and of quality, will only be used for the company’s operational purposes. The company will implement strict measures to maintain security and prevent unauthorized use of personal data.

Personal Data Collection

The company will collect and store personal data using lawful methods and will limit the collection and storage of personal data to what is necessary for the purposes outlined in this policy.

Collected personal data includes titles, names, surnames, gender, birth dates, religion, nationality, marital status, criminal records, employment start dates, addresses, contact numbers, emails, ID numbers, bank account numbers, financial information, education and training records, work and performance records, employee codes, health information, social security numbers, driving licenses, tax identification numbers, photos, video images, emergency contact information, fingerprints, facial recognition data, website log files, and cookie IDs.

The company will seek consent from the data owner before or at the time of collection, except in the following cases where consent is not required:

• To comply with laws, regulations, regulatory requirements, contracts, and necessary conditions for the company’s services.
• For the benefit of the data owner’s life, health, or safety.
• For the company’s legitimate interests.

The company will not store personal data related to health records, religion, fingerprints, facial recognition data, criminal records, or any data that could lead to discrimination or defamation, and will not use personal data for publicizing information, promotions, or sales analysis to improve products and services without written consent from the data owner.

The company will collect personal data directly from the data owner and may collect personal data from other sources only if:

• The data owner has been informed of the collection from other sources.
• The data owner has given consent, or the data collection is exempt from consent as specified in point 3 or is public information.

The company collects personal data in paper form and in computer systems, including cloud systems, with restricted access.

The company will retain personal data for up to 10 years from the end of employment or the end of legal or regulatory requirements, except for commercial data which will be retained throughout the company’s operations.

After the retention period, the company will destroy personal data by shredding documents or deleting electronic data.

Purpose of Personal Data Collection

The company collects personal data for the following purposes:

• To comply with laws, regulations, regulatory requirements, contracts, and necessary conditions for the company’s operations and management.
• For the benefit of the data owner’s life, health, or safety.
• For the company’s legitimate interests.
• For the company’s marketing activities.
• To improve the quality of the company’s services.
• To organize activities related to investor relations.
• To assess the capabilities of employees and job applicants.
• To manage employee compensation or other benefits.

The company will not act contrary to the purposes of data collection unless a new purpose is communicated to the data owner and consent is obtained (as applicable)

If the purpose of personal data collection changes, the company will inform the data owner and seek consent (as applicable).

Personal Data Processing

The company will use or disclose personal data only with the data owner’s consent and solely for the purposes outlined in this policy, except:

• To comply with laws, regulations, regulatory requirements, contracts, and necessary conditions for the company’s services.
• For the benefit of the data owner’s life, health, or safety.
• For the company’s legitimate interests.
• When necessary to comply with the law, to assess employee performance, for labor protection, and for social security.

The company may need to disclose personal data to affiliated companies or government agencies as required by law, such as the Revenue Department, the Department of Welfare and Labor Protection, the Social Security Office, and banks.

If the company hires other companies or agencies to handle personal data, such as statistical analysis or database maintenance, it will ensure that these entities maintain the confidentiality and security of personal data. Before disclosing personal data, the company will create agreements prohibiting the use of personal data beyond the company’s activities.

Data Security

The company recognizes the importance of personal data security and has established appropriate measures to maintain the security and confidentiality of personal data, preventing loss, unauthorized access, destruction, use, alteration, or disclosure, and in accordance with the company’s IT security policies and procedures.

Rights of Personal Data Owners

Right to Withdraw Consent
The data owner has the right to withdraw consent for the processing of personal data at any time while the data is held by the company.

Right to be Informed
The data owner has the right to be informed about the data, processing purposes, their rights, or any actions taken on personal data.

Right of Access

The data owner has the right to access their personal data and request a copy, as well as request disclosure of how the data was obtained if consent was not given.

Right to Rectification
The data owner has the right to request the correction of inaccurate data or the addition of incomplete data.

Right to Erasure
The data owner has the right to request the deletion of data for certain reasons.

Right to Restrict Processing
The data owner has the right to restrict the use of personal data for certain reasons.

Right to Data Portability
The data owner has the right to transfer personal data provided to the company to another data controller or to themselves for certain reasons.

Right to Object
The data owner has the right to object to the processing of personal data for certain reasons.

Right to Lodge a Complaint

The data owner has the right to lodge a complaint if they believe the company or its representatives have violated their rights under Section 5 of the Personal Data Protection Act B.E. 2563.

Personal data owners can notify the company’s data protection officer of their wishes.
If the exercise of the data owner’s rights affects the company’s necessary activities and/or the data owner cannot provide reasonable grounds, the company may refuse the request.

The company may charge a fee for processing such requests.

Changes to the Privacy Policy

The company may update this privacy policy from time to time to align with changes in services, company operations, and feedback from data owners. The company will clearly announce any changes before implementation or may notify data owners directly.

Contact Information

For further inquiries or to exercise your rights, please contact:

Alla Public Company Limited
Secretary of the Data Protection Committee
933, 935, 937, 939 Soi On Nut 46, On Nut Road, On Nut Subdistrict, Suan Luang District, Bangkok 10250
Phone: 02-3220777
Fax: 02-3221891
Email: legal@alla.co.th