Carrier Air Conditioning (Thailand)

PDPA Privacy Notice

Introduction

Toshiba Carrier (Thailand) Co., Ltd. (“TCTC”) is fully committed to diligently guard the privacy of your personal data. Your personal data is a precious asset, and an important resource for TCTC for creating new value, which is why TCTC strictly observes the Personal Data Protection Act B.E. 2562 (“PDPA”) to ensure best practices with respect to protection of your personal data.

This Privacy Notice contains what types of personal data TCTC collects, how TCTC collects and uses your personal data, when and who TCTC will disclose or transfer your collected personal data to, when TCTC will inform you of the collection of your personal data and your rights and how you can exercise them, what measures or procedures TCTC takes to ensure your collected personal data remains private and secure, how long TCTC retains your personal data, and how you can contact us. This Privacy Notice applies to the personal data TCTC collects about:

customers and potential customers;

suppliers, distributors and business partners, including their employees and contact persons;

job applicants; and

visitors of TCTC's website and premises.

Please take a moment to read this Privacy Notice to understand your rights to your personal data given to TCTC. This Privacy Notice may change during our relationship with you; therefore, you should come back and read this Privacy Notice from time to time.

1. What types of personal data does TCTC collect?

Your personal data means any information relating to you that TCTC can identify you, whether directly or indirectly, from that data alone or in a combination with other identifiers TCTC possesses or can reasonably access. The types of personal data TCTC collects from you may be different depending on the scope of products and/or services you are interested in or other kind of relationships with TCTC. The collected personal data may include:

General Personal Data

Name and surname

Gender

Date of birth

Educational background

Occupation background

Marital status

Nationality

Address

Email address

Contact number

Social media account

Identification card number

Passport number/Information

Driving license number

Photo

Video surveillance/CCTV footage

Information about how you use TCTC's websites, applications or other technologies, including IP addresses or
other devices information; and

Other information that you have given TCTC

Sensitive Personal Data

Only to the extent necessary in each specific case, TCTC may also collect and retain your sensitive personal data which may include:

Religious or philosophical beliefs;

Criminal records;

Health data or disability condition;

Genetic data; and

Biometric data

If you do not or are unable to provide your personal data which TCTC requires, TCTC may not be able to establish a relationship with you
or offer you products and/or services.

2. How TCTC collects your personal data?

TCTC may collect your personal data directly from you when you interact with TCTC (including through the website, email and telephone), such a s when you purchase any of TCTC’s products or services, register the products, participate in any of TCTC’s surveys or apply for a position with TCTC.

TCTC may also collect your personal data indirectly from third parties, such as:

TCTC’s business partners, suppliers, service providers, consultants, contractors and subcontractors (such as customer
service operators);

TCTC’s affiliated or group companies;

Persons who may know you; or

Public sources.

3. How does TCTC use your collected personal data?

TCTC will use or process your collected personal data by fair and lawful means to the extent necessary for specific purposes. TCTC has also set out some lawful reasons why TCTC may use or process your collected personal data.

Depending on the type of personal data TCTC is processing, TCTC may process your collected personal data when it is necessary to prevent or avoid danger to a person’s life, body and health (Vital interests) or to engage in business with TCTC or provide products and/or services set out in a contract (Contracts), when it is in TCTC’s legitimate interests to process your personal data (Legitimate interests), when it is required or allowed by any relevant and applicable laws (Legal obligations) or when TCTC has your permission (Consents).
The details of each purpose are as follows:

3.1 Vital interests
TCTC will rely on the vital interest purpose for which the processing of your collected personal data is necessary to prevent or avoid danger to a person’s life, body or health.

3.2 Contracts
TCTC will rely on the contract purpose for which the processing of your collected personal data is necessary for the performance of contracts to which you are a party or in order to take steps at your request before entering into contracts.

TCTC will process your collected personal data in accordance with the contract between us, and for the following reasons:

Delivering products and/or services to you or procuring them from you;

Administering, implementing, maintaining, managing and operating TCTC’s products and/or services;

Arranging, processing, assessing and determining any applications, requests or claims made by you in connection with
TCTC’s products and/or services;

Exercising rights or performing obligations that TCTC may have in connection with the products and/or services;

Issuing warranty certificates and providing warranty services;

Issuing or executing contracts and maintaining your account with TCTC;

Exercising rights or performing obligations under executed contracts; or

Participating in activities organised by or on behalf of TCTC.

3.3 Legitimate interests

TCTC will rely on the purpose of legitimate interests pursued by TCTC or by a third party which require TCTC to process your collected personal data, except where such interests are overridden by your interests or fundamental rights and freedoms. To give you an idea of when TCTC will rely on the legitimate interests, after considering your interests, rights and freedoms, TCTC has legitimate interests which allow TCTC to process your collected personal data in the following circumstances:

Liaising, communicating business transactions and establishing as well as managing relationships; or

Maintaining security and safety of persons and properties on TCTC’s premise.

3.4 Legal obligations

TCTC will rely on the purpose of legal obligations for which the processing of your collected personal data is necessary for compliance with a legal obligation to which TCTC is subject.

3.5 Consents

TCTC will process your collected personal data on grounds of consents; especially, in the case where the processing activities have potential impact on your sensitive personal data.
TCTC will inform you of the objectives of personal data processing and request your consent or explicit consent to process your collected personal data in the following circumstances:

When TCTC does not have other lawful grounds to collect your general personal data or sensitive personal data;

When TCTC intends to transfer your collected personal data overseas and the destination country has lesser data privacy
standards;

When you are classified as a minor, quasi-incompetent or incompetent of which the consent will be requested from your legal
representatives, guardians or curators, as the case may be; or

When TCTC intends to send you information on products and/or services, special promotions or other marketing information.

4. When does TCTC disclose or transfer your collected personal data?
TCTC will not disclose or transfer your collected personal data to any third parties, except in the cases where:

there is an agreement with the person(s) concerned;

it is required to do so by law or legal process;

it is necessary to protect the life, body or health of others, and the agreement of the person concerned is difficult to obtain;

the handling of personal data is entrusted to a third party, within the range needed to achieve the agreed purpose of use;

business activities are taken over as a result of mergers, corporate splits, business transfer, or for other reasons; or

TCTC considers it is appropriate to have the affiliated, group companies or agents respond to customers inquiries regarding
products, repairs or services.

For overseas disclosure or transfer, TCTC will only disclose or transfer your collected personal data to a country that, in the view of the Thai Personal Data Protection Commission, has adequate data protections laws, and where necessary, TCTC will follow criteria, guidelines or safeguards in relation to data security and cross-border transfer commonly practiced under the General Data Protection Regulation (GDPR).
Where such data security standards are deemed inadequate, TCTC will provide appropriate safeguards to protect your interest and the disclosure or transfer will take place if one of the exceptions defined by the PDPA is met. The exceptions are where:

the transfer is necessary for compliance with the law;

you have explicitly consented to the proposed transfer after having been informed of the possible risks of such transfer due to
the absence of adequate security standards or safeguards;

the transfer is necessary for the performance of a contract with you or the implementation of pre-contractual measures taken at
your request;

the transfer is necessary for the conclusion or performance of a contract in your interest between us and another natural or
legal person;

the transfer is necessary to protect your vital interests or those of other persons, and the data subject is incapable of giving
consent; or

the transfer is necessary for important reasons of public interest.

5. When TCTC will inform you of the collection of your personal data?

TCTC will always inform you of the purposes of processing your personal data, before or at the time of collecting your personal data. However, in some cases, it is not necessary for TCTC to inform you of the processing purposes, such as when:

you are already aware of such new purposes or details of our processing;

TCTC believes that notice of such new purposes or the details of our processing is impossible or will obstruct the use or
disclosure of your personal data, where TCTC has taken suitable measures to protect your rights, freedoms and interests;

it is urgent to use or disclose your collected personal data as required by laws and TCTC has implemented suitable measures
to protect your interests; or

TCTC is aware of or acquire your personal data from our duty, occupation or profession, and TCTC has maintained
such new purposes or certain details with confidentiality as required by laws.

6. Your rights

You have rights to your personal data according to the PDPA. These rights include:

Right to access
You have a right to access and obtain a copy of personal data that TCTC holds about you, or you may ask TCTC to disclose the sources of where TCTC obtained your collected personal data that you have not given consent.

Right to data portability
You have a right to request TCTC to transfer your collected personal data to other persons/organisations, or request to see your collected personal data that TCTC has transferred to other persons/organisations, unless it is impossible due to technical circumstances.

Right to object to the processing of your collected personal data
You have a right to object to the processing of your collected personal data, unless there are circumstances that do not allow you to make the objection. This may include when TCTC has compelling legitimate interests ground or when the processing of your collected personal data is carried out to comply, exercise or defend legal claims or for the public interest.

Right to erasure
You have a right to request TCTC to delete, destroy or anonymise your collected personal data in the following circumstances where:
a) Your collected personal data is no longer necessary for the purpose for which it was collected, used or disclosed;
b) You have withdrawn your consent to which the collection, use or disclosure is based on and TCTC does not have legal
grounds to collect, use or disclose your collected personal data;
c) You have objected to the collection, use or disclosure of your collected personal data and TCTC does not have legal
grounds to reject such request; and/or
d) Your collected personal data has been unlawfully collected, used or disclosed under the PDPA.

Right to restrict the processing of your collected personal data
You have a right to request TCTC to restrict the processing of your collected personal data in the following circumstances when:
a) It is under the pending examination process of checking whether your collected personal data is accurate, up-to-date,
complete and not misleading;
b) It is your collected personal data that should be deleted or destroyed as it does not comply with the laws, but you request
to restrict it instead;
c) Your collected personal data is no longer necessary to be retained for the purpose for which it was collected, used or
disclosed, but you still have the necessity to request the retention for the purposes of the establishment, compliance,
exercise of legal claims or the defence of legal claims;
d) TCTC is pending verification in order to reject the objection request to the collection, use or disclosure of your collected
personal data.

Right to rectification
You have a right to rectify inaccurate collected personal data in order to make it accurate, up-to-date, complete and not misleading. If TCTC rejects your request, TCTC will record such rejection with reasons.

Right to lodge a complaint
You have a right to make a complaint in the case where TCTC, TCTC’s data processors including TCTC’s employees or contractors do not comply with the PDPA or other notifications or announcements under the PDPA.

Right to withdraw consent
You may withdraw your consent at any time, unless TCTC has a lawful basis to deny your request.
If you change your mind about how you would like TCTC to have or process your collected personal data and would like to withdraw your consent, you can tell TCTC anytime by following the withdrawal process at https://www.toshiba-carrier.co.th.

7. How do you exercise your rights?

You can exercise your rights by making a request through TCTC’s official channels at HRS If necessary, TCTC may require you to confirm your identity or provide additional information to support and to enable TCTC to complete your request.

In the case of more than 2 consecutive requests are made within 30 days, or in the circumstance of obviously excessive or unfounded requests, TCTC are entitled to full rights and sole discretion to either fulfil, decline or charge a reasonable fee to fulfil your requests.

TCTC are entitled to refuse your request on statutory grounds; in such case, TCTC will notify you of the refusal together with our reasonable grounds.

8. How does TCTC ensure your collected personal data remains private and secure?

TCTC uses a range of measures to keep your collected personal data safe and secure other forms of security. TCTC requires its employees and third parties who carry out work on TCTC’s behalf to comply with the PDPA and the appropriate privacy standards including obligations to protect any leakage of information and to apply appropriate security measures for the processing of personal information.

TCTC consistently maintains and updates the security procedures and measures taking into account the appropriate physical, technical and organisational security procedures and measures to ensure a level of security of your collected personal data appropriate to the respective risk and the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing, including to prevent loss and unauthorised collection, access, use, modification, correction, disclosure or otherwise processing of your collected personal data. TCTC’s security measures apply to all types of data processing regardless of whether the collected personal data is processed electronically or in paper form.

TCTC assures that all collected personal data will be stored safely and securely with strict and adequate security standards. If you have a reason to believe that your collected personal data has been breached or if you have any questions regarding this Privacy Notice, please contact TCTC at the provided details in the “How can you contact us?” section.

9. How long will TCTC retain your collected personal data?

TCTC will keep your collected personal data for as long as it is necessary for the relevant activity unless a longer retention period is required or permitted by laws (e.g. up to five years under Accounting Laws and Tax Laws) which in many cases is up to 10 years after the end of our relationship with you. If TCTC needs to keep your collected personal data for a longer period to comply with the legal obligation, or if some existing claims or complaints will reasonably require TCTC to keep your collected personal data for regulatory or technical reasons, TCTC will continue to protect that collected personal data.

TCTC may need to retain images and video footages from CCTV surveillance systems installed for security and safety of persons and properties within TCTC’s premises for 30 days.

TCTC will delete, destroy, permanently anonymise or otherwise dispose of all collected personal data at the end of the retention period, or when TCTC must comply with your request for erasure of your collected personal information.

If you have any questions, please contact TCTC at the provided details in the “How can you contact us?” section.

10. Cookies

Cookies are bits of text files that are automatically placed and stored on your computer to collect standard internet log information and your behaviour information on website. TCTC will use cookies on website to help identify site features in which you may have the greatest interest and improve the services and communication to you to provide you with a better user experience.

Keep in mind that you can disable cookies by changing the settings of your web browser, but it may affect you on how you use the website or may cause some of the website features not to function properly.

11. Changes to the Privacy Notice

TCTC reserves the right to change, amend or update the Privacy Notice at any time as it deems appropriate and will notify you whenever there is any such change, amendment or update on TCTC’s website at https://www.toshiba-carrier.co.th in which you can check at any time.

12. How can you contact us?

If you have any comments, suggestions, questions or want to make a complaint or exercise your rights regarding your personal data, please contact us at

Name	Niphat Vibulchak
Position	Senior Specialist
Division	AHE
Contact information	[email protected] Telephone: 02 – 0213100 # 3183