Chevalier iTech Thai Co., Ltd. realizes the importance of Data Protection in regard to the data subjects who are staff, employees or applicants of the Company. As the fundamental rights to privacy of individuals, data subjects will wish to have their information under secure protection. In addition, the law on personal data protection has established criteria or measures to regulate personal data protection regarding the collection, usage and disclosure of personal data and various rights of data subjects. Therefore, Company has established this Policy as a basis for the protection of personal data of the data subjects as follows:

1. Definitions
“Company” means Chevalier iTech Thai Co., Ltd.
“Data subject” means any staff, employee or applicant of the Company who is the subject of the information.
“Person” means any natural person.
“Company Group” means Chevalier iTech Thai Co., Ltd; Chevalier Network Solutions Co., Ltd; and Sup Aswin Co., Ltd.
“Data controller” means the Company with the authority to make decisions regarding the personal data that the Company has received from data subjects or due to services provided for data subjects, or is required to perform or fulfill the contracts with data subjects.
“Data protection officer” means any staff appointed by the data controller to perform duties of the data protection officer according to Personal Data Protection Act B.E. 2562 (2019).
“Data processor” means anyone who processes personal data for the Company.
“Personal data” means personal information that can help identify the person, either directly or indirectly, according to the Personal Data Protection Act B.E. 2562 (2019).
“Business alliance” means any trading partner that is a business alliance of or cooperates with the Company.

2. General Information
This Personal Data Protection Policy has been established to state details as well as protection and management methods regarding personal data of staff, employees or applicants of the Company in order to be in accordance with the amended service guidelines and legal criteria. Therefore, data subjects should always follow up on the Personal Data Protection Policy.

3. Personal Data Collection, Usage and/or Disclosure
3.1 Regarding personal data collection, usage and/or disclosure, the Company will use lawful means to collect, use and/or disclose personal data of data subjects with limitation and only to the extent necessary for the purposes of the personal data collection, usage and/or disclosure according to the provisions of the law.
3.2 The Company may collect, use and/or disclose personal data provided by data subjects, remained with the Company, or obtained or accessible by the Company from other reliable sources, e.g. Ministry of Labor Social, Security Office, Department of Skill Development, the Company Group, etc.
3.3 In case that data subjects do not provide personal data, or offer inaccurate or outdated information to the Company, the data subjects may not be able to perform any transaction with the Company, or may not be facilitated or fulfilled according to existing contracts with the Company, and may suffer any damage or loss of opportunity. Additionally, this may affect the legal compliance required to followed by data subjects or the Company.
3.4  Personal data collected, used and/or disclosed by the Company can be in 2 categories as follows:
           1.  Personal Information, such as:
1.1 Identification Information and contact details of the data subjects, e.g. photos, first name – last name, national ID number, Copy of ID card, Passport number (in the case of foreigners), gender, date of birth, age, status, address, occupation, place of work, telephone number, fax number, email
1.2 Other personal information, e.g. marital status, information about children, emergency contact details and beneficiaries
1.3 Information about the job, e.g. position or status, job title, department, contract details, personal record, employment history and application form
1.4 Information about salary and benefits of data subjects, e.g. information on wages, salaries, compensation and other related benefits.
1.5 Bank account information for payments of wages, compensations, or various welfare
1.6 Information about leave and absence, e.g. absent dates or vacations and other leaves of data subjects
1.7 Information about disciplinary actions, e.g. misconduct or inappropriate behavior as an employee
1.8 Evaluation history, e.g. performance evaluation and performance review
1.9 Educational background, e.g. academic records, academic transcripts, diploma
1.10 Military status
1.11 Information about securities holding and other related information
           2.  Sensitive Data means any personal data that is truly personal to data subjects according to Section 26 of the Personal Data Protection Act B.E. 2562 (2019), e.g. biological data, fingerprint data, Face Scan / Face Recognition, religious information as included in the copy of national identification card (if any), criminal records, including alleged offenses or prosecutions, health information, labor union information
The Company has no policy to store sensitive data of the data subjects, except
(1) In any case that the Company has received express consent of the data subjects, or
(2) Any other cases as specified by law
3.5 Retention period for personal data: The Company will retain personal data of data subjects for as long as necessary to fulfill the purposes notified to the data subjects, or according to the purposes stated in this Policy. In case that the data subjects terminate their relationship or employment with the Company, or no longer use services of or perform any transaction with the Company, the Company will store personal data of data subjects for 10 years thereafter, or for the period specified by law, or according to the statute of limitations, or for the exercise of legal claims. Upon the expiration of the retention period for such personal data, the Company will delete or destroy the personal data, or make the personal data non-identifiable to the data subjects.

4. Purposes of Personal Data Collection, Usage and/or Disclosure and Data Processing
The Company may collect, use and/or disclose personal data of data subjects for the following purposes:
4.1 The Company requires the consent of data subjects to collect, use and/or disclose sensitive data of data subjects for the following purposes:
4.1.1 Biological data, e.g. fingerprints, Face Scan / Face Recognition for building access, work time recording, or connection with various work systems of the Company
4.1.2 Religious data as appeared on copies of ID card (if any) for identification and authentication
4.1.3 Criminal records and health data for the consideration of job applications and employment, background check and monitoring
4.2 The Company may act based on criteria or other legal bases in regard to the collection, usage and/or disclosure of personal data of data subjects:
4.2.1 To fulfill the contracts in case of employment or contract compliance with data subjects;
4.2.2 To perform legal duties;
4.2.3 To have the legitimate interests of the Company or third parties in balance with the benefits and basic rights to personal data protection of data subjects;
4.2.4 To prevent or stop danger to a person's life, body, or health;
4.2.5 For the sake of public interest under the mission or exercise of state power, the Company will apply the criteria or legal bases in (4.2.1) to (4.2.5) above in order to collect, use and/or disclose personal data of data subjects for the following purposes:
In case of applicants
If data subjects are job applicants, the Company will apply the criteria or legal bases in 4.2 (4.2.1 to 4.2.5) above in order to collect, use and/or disclose personal data of data subjects for the following purposes:
- Processing application forms of data subjects for internships, part-time work, temporary work or employment
- Personal identification and contact
- Evaluation and rating of applicants for employment decision
- Suitability assessment
- Determination of salary or remuneration and others
- Background check due to the Company's criteria if data subjects are offered job positions with the Company
- Emergency contact to any person designated by data subjects
- Other purposes reasonably required by the Company as stated in application forms or any related documents
In case of the Company’s staff or employees
If data subjects are the Company’s staff or employees, the Company will apply the criteria or legal bases in (4.2.1) to (4.2.5) above in order to collect, use and/or disclose personal data of data subjects for the following purposes:
- Personnel recruitment, e.g. any decision to hire or change the employment contract type (such as changing the status of data subjects from interns, temporary or part-time staff to full-time employees)
- Internal management, e.g. manpower allocation, transfer and change of duty, promotion and retirement, etc.
- Training and personnel development, e.g. orientation and job introduction, organization of training courses both internal and external, training registration, and filing application for program certification along with training expenses from government agencies, etc.
- Payments of salary, compensation and benefits, e.g. wages, salary increase rate, bonus and welfare
- Management and leave of absence in accordance with the work regulations of the Company
- Communication, including references and recommendations
- Statistical and analytical purposes for personnel development and work process improvement
- Compliance with legal obligations, e.g. requirements on labor, health and safety, or as requested by government agencies
- Records of disciplinary actions against employees for efficient management or exercise of disciplinary actions when necessary
- Internal investigation to follow up on complaints or claims, monitor inappropriate behaviors of employees and to prevent fraud
- Emergency contact to any person designated by data subjects
- Prevention of employee activities which are unlawful or neglect of duty
- Confidentiality of information and assets of the Company
- Other purposes related to employment of data subjects (e.g. any activities or operations on behalf of the Company) or as specified in the employment contracts of data subjects, work regulations, or any documents related to human resources.
4.3 The Company will not collect, use and/or disclose personal data of data subjects beyond the purposes that the Company has informed the data subjects, unless:
4.3.1 Any new purpose has been notified to and with consents of the data subjects
4.3.2 In any case required by laws

5. Disclosure of Personal Data
5.1 The Company may disclose personal data of data subjects according to purposes that the Company has informed data subjects only as the Company will disclose personal data of data subjects in the following cases:
5.1.1 The Company has obtained consents from data subjects.
5.1.2 It is necessary to fulfill the contracts or the requests of the data subjects, including disclosure to carry out transactions or activities of the data subjects and achieve the goals of the data subjects.
5.1.3 It is necessary for legitimate interests, e.g. disclosure to juristic persons or organizations for investigation and prevention of fraud, records of meetings or transactions with the Company for the sake of the Company’s security, etc.
5.1.4 It is to comply with the law or official regulations, or orders of regulatory agencies or official agencies with legal authority, e.g. Ministry of Labor, Social Security Office, Department of Skill Development, Legal Execution Department, Student Loan Fund, Court, Police or any other government agencies as required by law, etc.
5.1.5 Disclose to individuals or juristic persons or any other organization as follows:
(1) External service providers of the Company, e.g. provident fund managers, banks, payment service providers, the Company, insurance, hospitals, visa or work permit agencies, consulting companies or information system providers, human resource, training agencies, or financial service providers, which will access and process personal data of data subjects for the purposes specified in Section 4 of this Policy.
(2) Government agencies or other agencies with legal authority, e.g. Ministry of Labor Social Security Office, Department of Skill Development, Legal Execution Department, Student Loan Fund, Court, Police or other government agencies as required by law in order to comply with laws and regulations or legal obligations

6. Data Subject Participation
6.1 If data subjects wish to exercise their rights as stated, requests can be submitted in the format as specified by the Company. When the Company has received such requests, it will record, review and respond to the requests within reasonable periods.
6.2 If data subjects find that any personal information or sensitive data related to themselves is not accurate, they may notify the Company in order to correct or change the personal information or sensitive data. If the Company has grounds to deny the requests, the Company will respond with the reasons for the objection in the format as specified by the Company.
6.3  Data subjects have the rights to check the existence, nature of personal information and/or sensitive data, purposes of data usage as well as their rights as follows:
(1) Request copies or certified copies of their personal information and/or sensitive data.
(2) Request correction or change for the accuracy of their personal information and/or sensitive data
(3) Dispute or request suspension of usage or disclosure of personal information and/or sensitive data related to themselves
(4) Request deletion or destruction of personal information and/or sensitive data related to themselves
(5) Request information about the acquisition of personal information and/or sensitive data related to themselves, in the case that non-consensual information has been collected or retained
(6) Request for the termination of consent
(7) Transfer data to other data controllers
(8) Contact relevant companies or agencies when necessary
(9) Complaints in case that the Company, data processor, employee or contractor of the Company, or data processor does not comply with the personal data protection laws.
However, if the activities in which the Company processes your personal information and/or sensitive data are based on contracts, legitimate benefits or legal duties, the Company has the right to refuse the exercise the rights by data subjects according to (3) and (4).
In case that data processing is based on contractual consent, and the case that collection and usage of sensitive data are for contract compliance, if employees exercise their rights under (3), (4) and (6), the Company will not be able to fulfill the contracts, which will result in the termination of employment contract with the employees and/or inability to allocate certain types of benefits and welfare to employees.

7. Data Security Measures
The Company recognizes the importance of security safeguards for personal data of data subjects. Therefore, the Company has established measures to maintain data security appropriately to prevent loss, access, destruction, usage, change, modification, or disclosure of personal data with proper rights or illegally in order to be in accordance with policies and/or guidelines for IT security of the Company.

8. Enforcement of Personal Data Protection Policy
This Personal Data Protection Policy applies to all personal data collected, used and disclosed by the Company. In addition, the data subjects agree that the Company has the right to collect and use their personal data that the Company has already collected (if any), as well as any of their personal data that the Company currently collects and will collect in the future to be used or disclosed to others within the scope specified in this Personal Data Protection Policy.
This Personal Data Protection Policy is governed by and interpreted in accordance with Thai law as Thai courts have the authority to consider any disputes that may arise.

9. Third-Party Data
If data subjects have provided any personal data of third parties, e.g. spouse, child, father, mother, family members, beneficiaries, emergency contact persons, referees, and other persons related to their securities holdings, the data subjects certify that they have the authority to provide personal data of such persons, and must have the persons allow the Company to use such personal data in accordance with this Personal Data Protection Policy. Moreover, data subjects are responsible for informing such persons of this Personal Data Protection Policy and requesting consents from those relevant persons.

10. Policy Review and Contact Information
10.1  The Company may revise this Protection Policy occasionally in order to be accordance with changes in the Company's operations and your feedback. The Company will issue a notice of change prior to implementing the changes. In this regard, the Company may notify you directly or via other Company’s channels as you can review this Protection Policy via the channels specified by the Company.
10.2 If you have additional questions, please contact us at
Chevalier iTech Thai Co., Ltd.
540 Bamrungmuang Rd., Watdebsirin, Pomprabsuttupai, Bangkok 10100
Tel. 02-2264300

 

 

Announced on March 1, 2022

(Ms. Wipawadee Bunnark)

Managing Director