Personal Data Protection Policy
ONVALLA Co., Ltd. recognizes the importance of protecting personal data and respecting the privacy rights of data subjects. The Company is committed to collecting, using, disclosing, and processing personal data appropriately and in accordance with applicable laws and regulations.
1. Definition
Personal Data means any information relating to an individual that enables the identification of such individual, whether directly or indirectly, excluding information of a deceased person in particular.
2. Respect for Privacy Rights
2.1
The Company respects and recognizes the importance of privacy rights, personal data, and personal data protection. The Company acknowledges that data subjects expect security and protection when providing their personal data to the Company.
2.2
Personal data received by the Company that can identify the data subject and is complete, accurate, up-to-date, and of good quality shall be used only for the purposes of the Company’s operations. The Company shall implement strict security measures to maintain the security of personal data and prevent unauthorized use of such personal data.
3. Collection of Personal Data
3.1 Methods of Personal Data Collection
In collecting and retaining personal data, the Company shall use lawful methods and shall collect and retain personal data only to the extent necessary for the purposes specified in this Policy.
3.2 Types of Personal Data Collected
The personal data collected may include:
- Title, first name, and last name
- Gender, date of birth, religion, nationality, and marital status
- Criminal record
- Employment commencement date
- Address, telephone number, and email address
- National identification number
- Bank account number and financial information
- Education and training information
- Employment and performance evaluation information
- Employee identification number
- Health information
- Social Security number
- Driving license information
- Tax identification number
- Photographs and video recordings
- Emergency contact information
- Fingerprints
- Facial recognition data
- Website access information (Log Files)
- Cookie ID
3.3 Consent
The Company shall obtain consent from the data subject before or at the time of collecting personal data, except in the following circumstances where consent is not required:
- To comply with laws, regulations, rules, contractual obligations, and conditions necessary for providing the Company’s services
- To protect the vital interests, health, or safety of the data subject
- For the legitimate interests of the Company
3.4 Sensitive Personal Data
The Company shall not collect personal data relating to health history, religion, fingerprints, facial recognition data, criminal records, or information that may result in discrimination against or damage the reputation of the data subject.
The Company shall not use personal data for public relations, promotional activities, or sales data analysis for product and service development unless written consent has been obtained from the data subject.
3.5 Sources of Personal Data
The Company shall collect personal data directly from the data subject and may collect personal data from other sources only in the following circumstances:
- The data subject has been informed of the collection of personal data from such other sources; and
- Consent has been obtained from the data subject, or the collection falls under an exemption from the consent requirement under Section 3, or the information is publicly available.
3.6 Storage of Personal Data
The Company stores personal data in both paper-based and electronic formats, including Cloud systems with restricted access to such information.
3.7 Retention Period
The Company shall retain personal data for a maximum period of 10 years from the date of termination of employment or the date on which the relevant duties end, in accordance with applicable laws or requirements of regulatory authorities.
Commercial information shall be retained throughout the Company’s business operations.
3.8 Destruction of Personal Data
Upon expiration of the applicable retention period, the Company shall destroy personal data by destroying paper copies or deleting electronic data.
4. Purposes of Personal Data Collection
The Company collects personal data for the following purposes:
- To comply with laws, regulations, rules, contractual obligations, and conditions necessary for conducting business and managing the Company’s operations
- To protect the vital interests, health, or safety of the data subject
- For the legitimate interests of the Company
- For the Company’s marketing activities
- To improve the quality of the Company’s services
- To organize activities related to investor relations
- To assess the qualifications and capabilities of employees and job applicants
- To manage compensation and other benefits for employees
Changes to the Purposes of Collection
The Company shall not process personal data for purposes that differ from those specified in this Policy unless the new purpose has been communicated to the data subject and consent has been obtained where required.
If the purposes of collecting personal data are subsequently changed, the Company shall inform the data subject and obtain consent where required.
5. Processing of Personal Data
5.1 Use or Disclosure of Personal Data
The Company shall use or disclose personal data only with the consent of the data subject and solely for the purposes specified in this Policy, except in the following circumstances:
- To comply with laws, regulations, rules, contractual obligations, and conditions necessary for providing the Company’s services
- To protect the vital interests, health, or safety of the data subject
- For the legitimate interests of the Company
- Where necessary for compliance with laws concerning employee work capability assessment, labor protection, and social security
5.2 Disclosure to Relevant Organizations
The Company may be required to disclose personal data to affiliated companies or government authorities as required by law, such as the Revenue Department, the Department of Labour Protection and Welfare, the Social Security Office, banks, and other relevant authorities.
5.3 Engagement of Third Parties
Where the Company engages other companies or organizations to process personal data, such as for statistical data analysis or database improvement and maintenance, the Company shall require such companies or organizations to maintain the confidentiality and security of personal data.
Before disclosing personal data to such parties, the Company shall enter into an agreement prohibiting them from using such personal data for purposes other than the Company’s activities.
6. Personal Data Security
The Company recognizes the importance of maintaining the security of personal data and therefore establishes appropriate security measures consistent with the confidentiality requirements for personal data.
These measures are intended to prevent the loss of, unauthorized access to, destruction, use, alteration, modification, or disclosure of personal data without authorization or in violation of applicable laws.
Such measures shall comply with the Company’s policies and guidelines concerning information technology security.
7. Rights of Data Subjects
Data subjects have the following rights as prescribed by applicable laws:
7.1 Right to Withdraw Consent
Data subjects have the right to withdraw their consent to the processing of personal data for which they have previously provided consent, throughout the period during which their personal data is retained by the Company.
7.2 Right to Be Informed
Data subjects have the right to be informed about the collection and processing of their personal data, the purposes of processing, their rights, and any actions taken in relation to their personal data.
7.3 Right of Access
Data subjects have the right to access their personal data and request a copy of such personal data from the Company. They may also request information regarding the source from which personal data was obtained where such data was not provided directly by the data subject.
7.4 Right to Rectification
Data subjects have the right to request that the Company correct inaccurate personal data or complete incomplete personal data.
7.5 Right to Erasure
Data subjects have the right to request the deletion of their personal data under certain circumstances.
7.6 Right to Restriction of Processing
Data subjects have the right to request the restriction of the use or processing of their personal data under certain circumstances.
7.7 Right to Data Portability
Data subjects have the right to request the transfer of personal data that they have provided to the Company to another data controller or to themselves under certain circumstances.
7.8 Right to Object
Data subjects have the right to object to the processing of their personal data under certain circumstances.
7.9 Right to Lodge a Complaint
Data subjects have the right to lodge a complaint if they believe that their rights have been violated by the Company, its officers, or representatives.
Data subjects have the right to lodge a complaint with the committee appointed under Chapter 5 of the Personal Data Protection Act B.E. 2562 (2019).
Data subjects may submit their requests concerning the above rights to the Company’s designated officer.
If exercising any right affects activities that are necessary for the Company’s operations and/or the data subject cannot provide reasonable grounds for such request, the Company reserves the right to reject the request.
The Company may charge reasonable expenses for processing such requests from the person making the request.
8. Changes to the Privacy Policy
The Company may amend this Privacy Policy from time to time to reflect changes in its services, business operations, recommendations, or comments from data subjects.
The Company shall clearly announce any changes before they take effect or may directly notify data subjects of such changes.
9. Contact Information
If you have any questions or wish to exercise your rights as a data subject, please contact:
ONVALLA Co., Ltd.
Secretary of the Personal Data Protection Working Committee
Address
933, 935, 937, 939 Soi On Nut 46, On Nut Road,
On Nut, Suan Luang, Bangkok 10250, Thailand
Telephone: +66 2 322 0777
Fax: +66 2 322 1891
Email: legal@alla.co.th