Protection of personal data concerning the Company’s employees, partners and third parties

We, Thai Nippon Foods Company Limited (the “Company”, “we”, or “us”), collect, use and disclose your personal data as the Company’s employees, business partners, suppliers, contacted persons, customers, visitors or job applicants/candidates for the Company positions for the following purposes:
• It is for identification or verification of identity of the Company’s employees, business partners, suppliers, contacted persons, customers, visitors, or job applicants/candidates for the Company positions.
• It is for the Company to provide membership privileges and benefits to its customers and tailor the Company’s offers to the customers’ specific preferences.
• It is for the Company to conduct marketing activities. Please see ‘Marketing activities/communications’ below for further information.
• It is for the recruitment process and consideration of the qualifications of the job applicants/candidates for the Company positions, conducting the job interviews, and considering hiring/employing job applicants/candidates for the Company positions.
• It is for consideration on hiring/employing the job applicants/candidates for the Company positions in the future if they are not selected and employed at the first round of application in the event that the Company has any suitable positions available in the future.
• It is for the Company’s general human resources administration, including preparation of employee record/registration and employee’s identification cards, contacting and coordinating with the employees (or employees’ emergency contacts (if needed)), consideration and making decisions on promotion, pay rise, and/or bonus, organization of employees’ training programs including preparation of the employee training registration forms and employees’ participation/attendance records, and organization of the Company’s relationship strengthening activities.
• It is for compliance with, and performance of, the contracts between the Company and the employees, including sending relevant information to a bank for payment of salary, bonus and other benefits to the employees, sending relevant information to an insurance company, provident fund and/or other persons so that the employee receives such the welfares that the employees are entitled to. It is for compliance with, and performance of, the contracts between the Company and the Company’s business partners, suppliers, contacted persons, or customers.
• It is for compliance with the laws (including announcements, notifications, rules, regulations and criteria issued thereunder) with which the Company is obliged to comply such as the Labour Protection Act, the Social Security Act, the Workmen’s Compensation Act, the Skill Development Promotion Act, the Tax Laws, the Foreigner’s Working Management Emergency Decree, the Immigration Act, and the Civil and Commercial Code, etc.
• It is for facilitating the employees (including their spouse) in claiming/exercising the benefits from the Social Security Fund and/ the workmen’s compensation fund in various circumstances pursuant to the conditions prescribed by the relevant laws and government agencies.
• It is for compliance with the Standard for Preventing and Solving Drug Abuse in Establishment (SDE) established by the Department of Labour Protection and Welfare, which includes participation in sport events or other activities to comply with the standard.
• It is for the Company’s business operation and other operations that are necessary for legitimate interests of the Company, taking into account the fundamental rights of the data subject, including giving advice, assistance, cooperation, and/or coordination with the Company’s business partners, suppliers, contacted persons, and customers, and accounting and auditing of the Company’s accounts.
• It is for judicial and/or arbitration process (if any), including defending in a court or arbitral proceedings.
• In the case that there may be a business sale and purchase, transfer, merger, or business restructuring of the Company (or its parent company), it is for providing necessary and adequate information to those interested in acquiring the business of the Company or its parent company, and other related people for due diligence of the Company’s business to support the decision making of those interested, and for achieving successful business sale and purchase, transfer, merger or restructuring of the Company (or its parent company) (if any).
• It is for the achievement of the purpose relating to the preparation of the historical documents or the archives for public interest, or for the purpose relating to research or statistics, in which the suitable measures to safeguard the data subject’s right and freedoms are put in place.
• It is for other purposes in preventing or suppressing a danger to a person’s life, body or health.
• It is to prevent health issues and dangerous contagious disease as necessary.
• It is also for other purposes necessary for legitimate interests of the Company or any other persons or juristic persons other than the Company, except where such interests are overridden by the fundamental rights of the data subject of his or her personal data.
In addition, the Company collects sensitive personal data concerning its employees (with the explicit consent from the relevant employees in the case where the explicit consent is required by the Personal Data Protection Act B.E. 2562 (2019)) for the following purposes:
• The Company collects the employee’s criminal record to determine the suitability of the employee in performing duties in relevant positions.
• The Company collects the employee’s health, illness and disability information, including the employee’s medical examination report(s)/medical certificate(s) to determine the suitability of the employee in performing duties in the positions where health and disability factors are key qualifications. (For example, employees in the production line must be free of underlying disease(s) as specified in the recruitment procedure as follows: Hepatitis A, Hepatitis C, and the diseases specified under the Ministerial Regulation issued under the Food Act 1979, including leprosy, tuberculosis, drug addiction, alcoholism, filariasis, repulsive skin disease.) This is because the Company operates food factory business, and, therefore, needs to control production quality standards. In particular, the Company needs to minimize contamination in its food production processes. In addition, the Company also uses such information in the Company's general human resources administration, such as, in making a decision on position transfer to suit the employee's health, or in the case that the employee takes a sick leave for a period which a medical certificate is required to be submitted as evidence to the Company. The Company may also use such data to prevent health issues and dangerous contagious disease as necessary.
• The Company collects the employees’ fingerprint recognition data so that the employees verify their identities to enter or leave the workplace. It is for security purposes in the workplace and to record the employees' time-in and time-out of work.
The collected personal data relating to the purposes under items as listed above is necessary for us to comply with the contract or applicable laws. If you do not provide us with such necessary personal data for the purposes as stated above, we may not be able to perform or manage the contract, or to facilitate you.

We collect several types of personal data from you, including:
Personal data concerning the Company’s employees
• Identity data, e.g. name, surname, I.D. card number, passport number, birthdate, gender, age, nationality, signature
• Contact data, e.g. address, telephone/mobile phone number, e-mail
• Communication data, e.g. image or voice recordings when communicating with the Company’s business partners, suppliers, contacted persons, customers
• Information on participating in activities held by the Company, e.g. static images or videos of the activities
• a copy of the employee's house registration
• a copy of the employee's work permit and visa
• a copy of the first page of the employee's passbook as well as the bank account number
• the employee's educational background, as well as a copy of the employee's academic certificate(s)
• the employee's employment history and CV/resume
• the employee's military service history, as well as a copy the employee's certificate of release
• the employee's application form, as well as all the attached documents
• the employee's tax deduction information
• the employee’s emergency contact, his/her address, telephone number and relationship with the job employee (Remark: The employee must have obtained the consent to provide these personal data to the Company from his/her emergency contact.)
• other personal data concerning employees arising from or in connection with the employment, such as employment contract, leave record, performance evaluation result, position change or salary adjustment of, and record of disciplinary actions to, employees, etc.
Personal data concerning the job applicants/candidates for the Company positions
• Identity data, e.g. name, surname, I.D. card number, passport number, birthdate, sex, age, nationality
• Contact data, e.g. address, telephone/mobile phone number, e-mail
• Military service history as well as a copy of the certificate of release
• Educational background as well as copy of academic certificate(s) and proficiency in languages
• Employment history and CV/resume
Personal data concerning the Company’s customers
• Identity data, e.g. name, surname, birthdate and gender
• Contact data, e.g. telephone/mobile phone number, e-mail address

Sensitive personal data concerning the Company’s employees
• the employee's criminal record
• the employee's labor union membership information
• the employee's disability information, health and illness data, as well as such information appearing on the employee’s medical examination report(s)/medical certificate(s)
• the employee's fingerprint recognition data
Sensitive personal data concerning the job applicants/ candidates for the Company positions
• the job applicant/candidate's criminal record

The Company may collect your personal data from the following sources:
• From you (i.e. the data subject) directly
• From other sources For example, the Company may obtain personal data concerning job applicants/candidates for the Company’s positions through recruitment agency(ies) and reference persons, information relating to employees’ health from hospital(s) and the employees’ criminal records from the Royal Thai Police.
The Company receives personal data from the sources set out above as document or electronic data/soft files as submitted to the Company by the employee or through phone calls, verbally or emails.

If the Company’s customers have provided his/her consent to receive the marketing communications from the Company, the Company will send such member customers marketing communications including, among others, information relating to the Company’s products and services, sales promotion, and other marketing events.

Customers may withdraw their consent for marketing communications at any time. Please see ‘Your rights as a data subject’ below for further information on how to request for consent withdrawal.

The Company retains personal data in both hard copy form and electronic/soft copy form. Hard copies will be kept in locked cabinets, and electronic/soft copies will be stored in the Company’s computer system with password requirement for access.

We retain your personal data for as long as it is considered necessary for the purpose for which it was collected, used or disclosed as set out in this Privacy Notice. The criteria used to determine our retention periods include the cases that: we retain the personal data for the duration we have an ongoing relationship with you as Company's employees, business partners, supplier, customers, contacted persons, job applicants/candidates for company positions; and we may retain the personal data for a longer period as necessary to comply with applicable laws, or to be in accordance with legal prescription, or to establish, comply with or exercise, the rights to legal claims, or defend against the rights to legal claims, or comply with, for any other cause, our internal policies and regulations. Set out below please find guidelines of the periods for which we will retain types of personal data and documents containing personal data

1. Type of Data / Document : Employee’s name, surname and ID number and/or passport number, and employment contract
Period : Forever (notwithstanding the termination of employment of the relevant employee)

2. Type of Data / Document : Employee registration (and data used for preparing employee registration)
Period : 2 years from the employment termination date of each employee (or, in case there is a labor dispute, until the final order or judgment on relevant matter is issued/rendered)

3. Type of Data / Document : Data relating to payments of wages, overtime, holiday pay and holiday overtime to employees
Period : 2 years from the date of payment (or, in case there is a labor dispute, until the final order or judgment on relevant matter is issued/rendered)

4. Type of Data / Document : Account and documents supporting accounting
Period : 5 years from account closing date (or until delivery of account and document to the Chief Accounting Inspector in case the Company ceases its business operation without liquidation)

5. Type of Data / Document : Documents submitted to the Revenue Department (e.g. information on withholding tax with respect to salaries/wages with ID number of relevant employee specified, etc.) and documents submitted to the Social Security Office
Period : 5 years from submission date

6. Type of Data / Document : Employee’s criminal record
Period : For so long as the employee remains the Company’s employee.

7. Type of Data / Document : Other personal data concerning employees (including their emergency contacts) and other documents containing such data
Period : For so long as the employee remains the Company’s employee and another 3 years thereafter for hard copies and 5 years thereafter for electronic/soft copies

• 1 month from the date on which the Company receives the application from each job applicant/candidate for the Company positions. However, in the case where a job applicant/candidate is selected and employed as an employee of the Company, the Company may continue to retain personal data concerning him/her as employee for longer periods – see above.
Personal data concerning the Company’s customers
• For so long as the customer remains its membership and/or business relationship with the Company and 2 more years thereafter.

We may disclose your personal data in certain circumstances, for the purposes set out in this Privacy Notice to:
• Company’s subsidiaries, affiliated companies and companies under the same group for achieving the purposes specified above only.
• Government authorities, supervising authorities, independent organizations or other authorities as stipulated by laws, including competent officials exercising power or performing duties according to the laws, e.g. courts, police officers, the Revenue Department, Food and Drug Administration, the Department of Land, the Ministry of Industry, the Ministry of Commerce, the Ministry of Transportation, the Ministry of Public Health, the Ministry of Labor, the Legal Execution Department, the Office of the Attorney General, etc. in order to comply with applicable laws, lawful orders of government agencies or court’s orders to which the Company is subject.
• Bank and accounting company providing accounting and payroll services, insurance company, provident fund and provident fund manager in order to process payroll and provide benefits to the employees.
• Hospital engaged by the Company for checking the employees’ health as specified above.
• Royal Thai Police for obtaining the job applicants/candidates’ criminal records.
• External departments, organizations, or individuals involved in the exercising of claims, litigation, disputes, complaints or allegations against the Company, e.g. litigants, witnesses, etc.
• Agencies, contractors/sub-contractors and/or service providers for any operations, e.g. auditors, lawyers, legal advisors, service providers who transport passengers or parcels, visa and work permit service provider.
• Business partners, customers/clients and suppliers for carrying out the Company’s business.
• Prospective purchaser(s) of the business of the Company or its parent company, the person(s) interested in entering into the merger and acquisition transaction with the Company or its parent company, other person(s) relevant to the future business sale and purchase transaction, merger and acquisition transaction or business restructuring of the Company or its parent company (including their advisor(s) in relation to the relevant transaction).
• Third parties upon obtaining your consent or according to the performance of contracts or laws or based on the Company’s legitimate interest, as the case may be, including public media and online media.
In this regard, in the case where personal data must be transferred abroad, the Company will proceed in strict compliance with the Personal Data Protection Act BE. 2562 (2019).
If the Company must disclose personal data to any person set out above, the disclosure will be made on a limited basis and the Company will disclose only the data and/or the documents that are necessary to achieve the lawful purpose of the disclosure of personal data.

If you have any questions or inquiries about our protection of your personal data, collection, use or disclosure of your personal data, or how to exercise your rights as data subject, or have any complaints with regard to our personal data protection, please contact us at:
Thai Nippon Foods Company Limited
Company name: THAI NIPPON FOODS CO., LTD.
Address: 1/21 Rojana Industrial Park, Moo. 5, Kanham Village, U-Thai District, Ayutthaya 13210
E-mail: hr_tnf@tnf.co.th
Telephone: 035-330046, 035-330052
Website: http://www.thainipponfoods.com/

You have the rights as data subject according to the Personal Data Protection Act B.E. 2562 (2019) including the following rights:

1. Right to withdraw consent
In case the Company relies only on your consent as lawful basis to process personal data, you have the right to withdraw consent given to us for processing your personal data at any time, unless there is a restriction of the withdrawal of consent by law or, to the extent permitted by law, the contract which gives benefits to you.
However, the withdrawal of consent shall not affect the previous processing of personal data for which you have already given consent legally.

2. Right to access
You have the right to request access to and obtain copy of your personal data which is under our responsibility, and to request the disclosure of the acquisition of the personal data obtained without your consent.

3. Data portability right
You have the right to request us to transfer your personal data you have given to us as stipulated by law.

4. Right to object
You have the right to object the processing of your personal data on the grounds stipulated by law.

5. Erasure right
You have the right to request us to erase, destroy or make your personal data become unidentifiable data as stipulated by law.

6. Right to restrict processing
You have the right to request us to restrict the use of your personal data as stipulated by law.

7. Rectification right
In the case where you consider that your personal data in our possession is inaccurate or your personal data has changed, you have the right to request us to modify your personal data to be accurate, up-to- date, complete, and not misleading.

8. Right to be informed of any update made to Privacy Notice
We regularly review and, if appropriate, update this Privacy Notice from time to time to ensure that your personal data is properly protected. In case of any update to this Privacy Notice, we will inform you through the company's notice board or the Company's website or sending an e-mail to thainipponfoods@tnf.co.th.

9. Right to lodge a complaint
You have the right to lodge a complaint with competent officer under the Personal Data Protection Act B.E. 2562 (2019) if we violate or does not comply with such Act or notifications/announcements issued pursuant thereto.

In the case where the data subject submits a request to exercise the rights under the provisions of the Personal Data Protection Act B.E. 2562 (2019), upon receiving the request, we will proceed such request within the period as stipulated by law. In addition, we reserve the right to refuse or not process the request under certain circumstances as stipulated by law.

[Published on [•] January 2022]