ALLA Public Company Limited and its subsidiary, ONVALLA Co., Ltd., recognize the importance of your personal data that you have entrusted to the Company.
The Company is required to comply with the Personal Data Protection Act B.E. 2562 (2019) to ensure that individuals’ rights relating to the collection, use, and disclosure (“processing”) of personal data are appropriately protected.
This Privacy Notice is intended to inform you of the manner in which the Company collects, uses, and discloses your personal data. Please read this document carefully to understand the purposes for which the Company collects, uses, and discloses your personal data.
1. Purposes and Legal Bases for Processing Personal Data
The Company collects your personal data for the following activities:
- To comply with laws, regulations, rules, contractual obligations, and conditions necessary for conducting business and managing the Company’s operations
- To protect the vital interests, health, or safety of the data subject
- For the legitimate interests of the Company
- For the Company’s marketing activities
- To improve the quality of the Company’s services
- To organize activities related to investor relations
- To assess the qualifications and capabilities of employees and job applicants
- To manage compensation and other benefits for employees
2. Legal Bases for Processing Personal Data
The Company processes your personal data based on the following legal bases:
2.1 Contractual Basis
Contract
You are required to provide personal data to the Company for entering into and performing a contract.
If you do not provide the required personal data, the Company may be unable to communicate with you, fulfill the purposes of the contract, inspect or verify work under the contract, assess your ability to enter into the contract, or verify your identity.
This constitutes processing under Section 24 (3) of the Personal Data Protection Act B.E. 2562 (2019).
2.2 Consent Basis
Consent
The Company may collect your health information, fingerprints, and facial recognition data, which constitute biometric data, for processing purposes including assessing your qualifications for employment, recording working hours, and performing obligations under contracts with customers.
The Company may also collect general personal data for marketing activities, improving the quality of products and services, and investor relations activities.
If you wish to withdraw your consent, you may contact the Company and submit your request as specified in Section 4.
However, as such information is important for employee selection, working-time recording, and performance of obligations under contracts with customers, if you withdraw your consent, the Company reserves the right to refuse employment or refuse to calculate your working hours.
2.3 Legitimate Interest
Legitimate Interest
The Company may process your personal data for communication and business operations, fulfilling obligations between employers and employees, protecting life and property, and activities carried out for the benefit of shareholders.
Such processing is based on the legitimate interest basis under Section 24 (5) of the Personal Data Protection Act B.E. 2562 (2019).
2.4 Legal Obligation
Legal Obligation
The Company may process your personal data to comply with applicable laws and regulations, such as the Securities and Exchange Act B.E. 2535 (1992), the Anti-Money Laundering Act B.E. 2542 (1999), labor protection laws, and other laws requiring the disclosure of personal data.
This may include the Civil Procedure Code, which authorizes courts to order parties to submit documents or information for consideration in legal proceedings.
Such processing is based on the legal obligation basis under Section 24 (6) of the Personal Data Protection Act B.E. 2562 (2019).
3. Personal Data to Be Processed and Retention Period
The categories of personal data processed by the Company may include:
- Title, first name, and last name
- Gender, date of birth, religion, nationality, and marital status
- Criminal record
- Employment commencement date
- Address, telephone number, and email address
- National identification number
- Bank account number and financial information
- Education and training information
- Employment and performance evaluation information
- Employee identification number
- Health information
- Social Security number
- Driving license information
- Tax identification number
- Photographs and video recordings
- Emergency contact information
- Fingerprints
- Facial recognition data
- Website access information (Log Files)
- Cookie ID
The maximum retention period is 10 years from the date of termination of employment or the end of relevant duties under applicable laws or requirements of regulatory authorities.
Commercial information shall be retained throughout the Company’s business operations.
Upon expiration of the applicable retention period, the Company shall delete the personal data or anonymize it so that the data subject can no longer be identified.
Sensitive Personal Data
Please note that sensitive personal data appearing on identification documents, such as religion, race, and blood type, may be concealed by you.
If you submit documents without concealing such information, the Company will conceal such information itself. Such information shall not be deemed to constitute sensitive personal data received by the Company directly from the data subject.
4. Categories of Persons or Organizations That May Receive Personal Data
The Company may disclose personal data to third parties to the extent necessary to fulfill the primary purposes or related purposes of personal data processing.
Your personal data may be transferred or disclosed to:
- Companies within the same group or affiliated companies
- Customers or business partners
- Regulatory authorities
- Government agencies or relevant authorities
- The Securities and Exchange Commission
- The State Audit Office of the Kingdom of Thailand
- The Anti-Money Laundering Office
- The Office of the Consumer Protection Board
- The Royal Thai Police
- The Ministry of Justice
- The Revenue Department
- The Ministry of Labour
- Financial institutions
- The Social Security Office
- Any other person or organization to whom the Company is required to disclose information pursuant to applicable laws or regulations, or pursuant to a court order
5. Rights of Data Subjects
You have the following rights:
5.1 Right to Withdraw Consent
The right to withdraw your consent for the Company to process your personal data.
5.2 Right of Access
The right to access and obtain a copy of personal data collected, used, or disclosed by the Company.
5.3 Right to Data Portability
The right to request the transfer of your personal data.
5.4 Right to Object
The right to object to the processing of your personal data.
5.5 Right to Erasure
The right to request the deletion, destruction, or anonymization of your personal data so that it can no longer identify you.
5.6 Right to Restriction of Processing
The right to request the restriction of the use of your personal data.
5.7 Right to Rectification
The right to request that your personal data be corrected so that it is accurate, up-to-date, complete, and does not cause misunderstanding.
5.8 Right to Lodge a Complaint
The right to lodge a complaint if you believe that your rights under the Personal Data Protection Act B.E. 2562 (2019) have been violated by the Company, its officers, or representatives.
Any request to exercise the above rights must be submitted in writing. The Company will use its best efforts to process such requests within a reasonable period and no later than the period prescribed by law.
The Company shall comply with applicable legal requirements concerning your rights as a data subject.
In exercising the above rights, the Company reserves the right to charge any fees that are relevant and necessary for processing your request concerning personal data.
6. Changes to This Privacy Notice
To comply with the Personal Data Protection Act B.E. 2562 (2019), this Privacy Notice may be amended from time to time.
The Company will publish the current version of this Privacy Notice on its website.
Accordingly, the ALLA Public Company Limited Group and ONVALLA Co., Ltd. recommend that data subjects review the Personal Data Protection Policy each time they use the Company’s services or engage in any activities with the Company.
The relevant information may be accessed through the Company’s websites or other applicable channels.
7. Personal Data Protection Contact
If you have any questions or wish to exercise your rights as a data subject, please contact:
ONVALLA Co., Ltd. (Subsidiary)
Secretary of the Personal Data Protection Working Committee
Address
933, 935, 937, 939 Soi On Nut 46, On Nut Road
On Nut, Suan Luang, Bangkok 10250, Thailand
Telephone: +66 2 322 0777
Fax: +66 2 322 1891
Email: legal@alla.co.th