Carrier Air Conditioning (Thailand)

PDPA Privacy Notice

Introduction

Carrier Air Conditioning (Thailand) Co., Ltd. (“CTC”) is fully committed to diligently guard the privacy of your personal data. Your personal data is a precious asset, and an important resource for CTC for creating new value, which is why CTC strictly observes the Personal Data Protection Act B.E. 2562 (“PDPA”) to ensure best practices with respect to protection of your personal data.

This Privacy Notice contains what types of personal data CTC collects, how CTC collects and uses your personal data, when and who CTC will disclose or transfer your collected personal data to, when CTC will inform you of the collection of your personal data and your rights and how you can exercise them, what measures or procedures CTC takes to ensure your collected personal data remains private and secure, how long CTC retains your personal data, and how you can contact us. This Privacy Notice applies to the personal data CTC collects about:

customers and potential customers;

suppliers, distributors and business partners, including their employees and contact persons;

job applicants; and

visitors of CTC's website and premises.

Please take a moment to read this Privacy Notice to understand your rights to your personal data given to CTC. This Privacy Notice may change during our relationship with you; therefore, you should come back and read this Privacy Notice from time to time.

1. What types of personal data does CTC collect?

Your personal data means any information relating to you that CTC can identify you, whether directly or indirectly, from that data alone or in a combination with other identifiers CTC possesses or can reasonably access. The types of personal data CTC collects from you may be different depending on the scope of products and/or services you are interested in or other kind of relationships with CTC. The collected personal data may include:

General Personal Data

Name and surname

Gender

Date of birth

Educational background

Occupation background

Marital status

Nationality

Address

Email address

Contact number

Social media account

Identification card number

Passport number/Information

Driving license number

Photo

Video surveillance/CCTV footage

Information about how you use CTC's websites, applications or other technologies, including IP addresses or
other devices information; and

Other information that you have given CTC

Sensitive Personal Data

Only to the extent necessary in each specific case, CTC may also collect and retain your sensitive personal data which may include:

Religious or philosophical beliefs;

Criminal records;

Health data or disability condition;

Genetic data; and

Biometric data

If you do not or are unable to provide your personal data which CTC requires, CTC may not be able to establish a relationship with you
or offer you products and/or services.

2. How CTC collects your personal data?

CTC may collect your personal data directly from you when you interact with CTC (including through the website, email and telephone), such a s when you purchase any of CTC’s products or services, register the products, participate in any of CTC’s surveys or apply for a position with CTC.

CTC may also collect your personal data indirectly from third parties, such as:

CTC’s business partners, suppliers, service providers, consultants, contractors and subcontractors (such as customer
service operators);

CTC’s affiliated or group companies;

Persons who may know you; or

Public sources.

3. How does CTC use your collected personal data?

CTC will use or process your collected personal data by fair and lawful means to the extent necessary for specific purposes. CTC has also set out some lawful reasons why CTC may use or process your collected personal data.

Depending on the type of personal data CTC is processing, CTC may process your collected personal data when it is necessary to prevent or avoid danger to a person’s life, body and health (Vital interests) or to engage in business with CTC or provide products and/or services set out in a contract (Contracts), when it is in CTC’s legitimate interests to process your personal data (Legitimate interests), when it is required or allowed by any relevant and applicable laws (Legal obligations) or when CTC has your permission (Consents).
The details of each purpose are as follows:

3.1 Vital interests
CTC will rely on the vital interest purpose for which the processing of your collected personal data is necessary to prevent or avoid danger to a person’s life, body or health.

3.2 Contracts
CTC will rely on the contract purpose for which the processing of your collected personal data is necessary for the performance of contracts to which you are a party or in order to take steps at your request before entering into contracts.

CTC will process your collected personal data in accordance with the contract between us, and for the following reasons:

Delivering products and/or services to you or procuring them from you;

Administering, implementing, maintaining, managing and operating CTC’s products and/or services;

Arranging, processing, assessing and determining any applications, requests or claims made by you in connection with
CTC’s products and/or services;

Exercising rights or performing obligations that CTC may have in connection with the products and/or services;

Issuing warranty certificates and providing warranty services;

Issuing or executing contracts and maintaining your account with CTC;

Exercising rights or performing obligations under executed contracts; or

Participating in activities organised by or on behalf of CTC.

3.3 Legitimate interests

CTC will rely on the purpose of legitimate interests pursued by CTC or by a third party which require CTC to process your collected personal data, except where such interests are overridden by your interests or fundamental rights and freedoms. To give you an idea of when CTC will rely on the legitimate interests, after considering your interests, rights and freedoms, CTC has legitimate interests which allow CTC to process your collected personal data in the following circumstances:

Liaising, communicating business transactions and establishing as well as managing relationships; or

Maintaining security and safety of persons and properties on CTC’s premise.

3.4 Legal obligations

CTC will rely on the purpose of legal obligations for which the processing of your collected personal data is necessary for compliance with a legal obligation to which CTC is subject.

3.5 Consents

CTC will process your collected personal data on grounds of consents; especially, in the case where the processing activities have potential impact on your sensitive personal data.
CTC will inform you of the objectives of personal data processing and request your consent or explicit consent to process your collected personal data in the following circumstances:

When CTC does not have other lawful grounds to collect your general personal data or sensitive personal data;

When CTC intends to transfer your collected personal data overseas and the destination country has lesser data privacy
standards;

When you are classified as a minor, quasi-incompetent or incompetent of which the consent will be requested from your legal
representatives, guardians or curators, as the case may be; or

When CTC intends to send you information on products and/or services, special promotions or other marketing information.

4. When does CTC disclose or transfer your collected personal data?
CTC will not disclose or transfer your collected personal data to any third parties, except in the cases where:

there is an agreement with the person(s) concerned;

it is required to do so by law or legal process;

it is necessary to protect the life, body or health of others, and the agreement of the person concerned is difficult to obtain;

the handling of personal data is entrusted to a third party, within the range needed to achieve the agreed purpose of use;

business activities are taken over as a result of mergers, corporate splits, business transfer, or for other reasons; or

CTC considers it is appropriate to have the affiliated, group companies or agents respond to customers inquiries regarding
products, repairs or services.

For overseas disclosure or transfer, CTC will only disclose or transfer your collected personal data to a country that, in the view of the Thai Personal Data Protection Commission, has adequate data protections laws, and where necessary, CTC will follow criteria, guidelines or safeguards in relation to data security and cross-border transfer commonly practiced under the General Data Protection Regulation (GDPR).
Where such data security standards are deemed inadequate, CTC will provide appropriate safeguards to protect your interest and the disclosure or transfer will take place if one of the exceptions defined by the PDPA is met. The exceptions are where:

the transfer is necessary for compliance with the law;

you have explicitly consented to the proposed transfer after having been informed of the possible risks of such transfer due to
the absence of adequate security standards or safeguards;

the transfer is necessary for the performance of a contract with you or the implementation of pre-contractual measures taken at
your request;

the transfer is necessary for the conclusion or performance of a contract in your interest between us and another natural or
legal person;

the transfer is necessary to protect your vital interests or those of other persons, and the data subject is incapable of giving
consent; or

the transfer is necessary for important reasons of public interest.

5. When CTC will inform you of the collection of your personal data?

CTC will always inform you of the purposes of processing your personal data, before or at the time of collecting your personal data. However, in some cases, it is not necessary for CTC to inform you of the processing purposes, such as when:

you are already aware of such new purposes or details of our processing;

CTC believes that notice of such new purposes or the details of our processing is impossible or will obstruct the use or
disclosure of your personal data, where CTC has taken suitable measures to protect your rights, freedoms and interests;

it is urgent to use or disclose your collected personal data as required by laws and CTC has implemented suitable measures
to protect your interests; or

CTC is aware of or acquire your personal data from our duty, occupation or profession, and CTC has maintained
such new purposes or certain details with confidentiality as required by laws.

6. Your rights

You have rights to your personal data according to the PDPA. These rights include:

Right to access
You have a right to access and obtain a copy of personal data that CTC holds about you, or you may ask CTC to disclose the sources of where CTC obtained your collected personal data that you have not given consent.

Right to data portability
You have a right to request CTC to transfer your collected personal data to other persons/organisations, or request to see your collected personal data that CTC has transferred to other persons/organisations, unless it is impossible due to technical circumstances.

Right to object to the processing of your collected personal data
You have a right to object to the processing of your collected personal data, unless there are circumstances that do not allow you to make the objection. This may include when CTC has compelling legitimate interests ground or when the processing of your collected personal data is carried out to comply, exercise or defend legal claims or for the public interest.

Right to erasure
You have a right to request CTC to delete, destroy or anonymise your collected personal data in the following circumstances where:
a) Your collected personal data is no longer necessary for the purpose for which it was collected, used or disclosed;
b) You have withdrawn your consent to which the collection, use or disclosure is based on and CTC does not have legal
grounds to collect, use or disclose your collected personal data;
c) You have objected to the collection, use or disclosure of your collected personal data and CTC does not have legal
grounds to reject such request; and/or
d) Your collected personal data has been unlawfully collected, used or disclosed under the PDPA.

Right to restrict the processing of your collected personal data
You have a right to request CTC to restrict the processing of your collected personal data in the following circumstances when:
a) It is under the pending examination process of checking whether your collected personal data is accurate, up-to-date,
complete and not misleading;
b) It is your collected personal data that should be deleted or destroyed as it does not comply with the laws, but you request
to restrict it instead;
c) Your collected personal data is no longer necessary to be retained for the purpose for which it was collected, used or
disclosed, but you still have the necessity to request the retention for the purposes of the establishment, compliance,
exercise of legal claims or the defence of legal claims;
d) CTC is pending verification in order to reject the objection request to the collection, use or disclosure of your collected
personal data.

Right to rectification
You have a right to rectify inaccurate collected personal data in order to make it accurate, up-to-date, complete and not misleading. If CTC rejects your request, CTC will record such rejection with reasons.

Right to lodge a complaint
You have a right to make a complaint in the case where CTC, CTC’s data processors including CTC’s employees or contractors do not comply with the PDPA or other notifications or announcements under the PDPA.

Right to withdraw consent
You may withdraw your consent at any time, unless CTC has a lawful basis to deny your request.
If you change your mind about how you would like CTC to have or process your collected personal data and would like to withdraw your consent, you can tell CTC anytime by following the withdrawal process at https://www.toshiba-carrier.co.th.

7. How do you exercise your rights?

You can exercise your rights by making a request through CTC’s official channels at HRS If necessary, CTC may require you to confirm your identity or provide additional information to support and to enable CTC to complete your request.

In the case of more than 2 consecutive requests are made within 30 days, or in the circumstance of obviously excessive or unfounded requests, CTC are entitled to full rights and sole discretion to either fulfil, decline or charge a reasonable fee to fulfil your requests.

CTC are entitled to refuse your request on statutory grounds; in such case, CTC will notify you of the refusal together with our reasonable grounds.

8. How does CTC ensure your collected personal data remains private and secure?

CTC uses a range of measures to keep your collected personal data safe and secure other forms of security. CTC requires its employees and third parties who carry out work on CTC’s behalf to comply with the PDPA and the appropriate privacy standards including obligations to protect any leakage of information and to apply appropriate security measures for the processing of personal information.

CTC consistently maintains and updates the security procedures and measures taking into account the appropriate physical, technical and organisational security procedures and measures to ensure a level of security of your collected personal data appropriate to the respective risk and the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing, including to prevent loss and unauthorised collection, access, use, modification, correction, disclosure or otherwise processing of your collected personal data. CTC’s security measures apply to all types of data processing regardless of whether the collected personal data is processed electronically or in paper form.

CTC assures that all collected personal data will be stored safely and securely with strict and adequate security standards. If you have a reason to believe that your collected personal data has been breached or if you have any questions regarding this Privacy Notice, please contact CTC at the provided details in the “How can you contact us?” section.

9. How long will CTC retain your collected personal data?

CTC will keep your collected personal data for as long as it is necessary for the relevant activity unless a longer retention period is required or permitted by laws (e.g. up to five years under Accounting Laws and Tax Laws) which in many cases is up to 10 years after the end of our relationship with you. If CTC needs to keep your collected personal data for a longer period to comply with the legal obligation, or if some existing claims or complaints will reasonably require CTC to keep your collected personal data for regulatory or technical reasons, CTC will continue to protect that collected personal data.

CTC may need to retain images and video footages from CCTV surveillance systems installed for security and safety of persons and properties within CTC’s premises for 30 days.

CTC will delete, destroy, permanently anonymise or otherwise dispose of all collected personal data at the end of the retention period, or when CTC must comply with your request for erasure of your collected personal information.

If you have any questions, please contact CTC at the provided details in the “How can you contact us?” section.

10. Cookies

Cookies are bits of text files that are automatically placed and stored on your computer to collect standard internet log information and your behaviour information on website. CTC will use cookies on website to help identify site features in which you may have the greatest interest and improve the services and communication to you to provide you with a better user experience.

Keep in mind that you can disable cookies by changing the settings of your web browser, but it may affect you on how you use the website or may cause some of the website features not to function properly.

11. Changes to the Privacy Notice

CTC reserves the right to change, amend or update the Privacy Notice at any time as it deems appropriate and will notify you whenever there is any such change, amendment or update on CTC’s website at https://www.toshiba-carrier.co.th in which you can check at any time.

12. How can you contact us?

If you have any comments, suggestions, questions or want to make a complaint or exercise your rights regarding your personal data, please contact us at

Name	Niphat Vibulchak
Position	Senior Specialist
Division	AHE
Contact information	[email protected] Telephone: 02 – 0213100 # 3183