Privacy Notice for clients, vendors, visitors

Sumitomo Heavy Industries (Thailand) Ltd

1. General Provisions
Sumitomo Heavy Industries (Thailand) Ltd. (“Company”) places great importance on the protection of personal data so that you can be confident that the Company will protect and treat your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019). The Company, therefore, has prepared a Privacy Notice for processes related to clients, vendors, visitors (“Notice”) to clarify details, methods for managing and processing personal data that the Company receives from you, including explaining the purposes for collecting, using, disclosing, as well as the period for keeping such personal data and your rights in personal data owner status. The Company recommends that you read and understand the various regulations under the Notice. The details are as follows:
2. Definition

means Sumitomo Heavy Industries (Thailand) Ltd.

means clients, vendors, visitors, the participants of the training, and any other individuals involved in the company’s activities and operations.

“Personal Data”
means any information relating to a Person, which enables the identification of such person, whether directly or indirectly, but not including the information of the deceased Persons in particular.

“Data Processing”
means any operation or set of operations that is done to personal data or sets of personal data, whether by automatic means or not, such as collecting, recording, organizing, structuring, preserving, changing or modifying, receiving, considering, using, disclosing by transmission, dissemination or any other act which results in the availability, placement or combination, restriction, deletion or destruction.

“Sensitive Personal Data”
means Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee.

“Data Controller”
means a person or a juristic person having the power and duties to make decisions regarding the collection, usc, or disclosure of the Personal Data.

“Data Processor”
means a person or a juristic person who operates in relation to the collection, use, or disclosure of the Personal Data pursuant to the orders given by or on behalf of a Data Controller, whereby such Person or juristic person is not the Data Controller.

“Personal Data Protection Law”
means the Personal Data Protection Act B.E 2562 (2019) and related secondary laws and shall include any future amendments to the law.

3. Group or type of person that the Company collects personal data
Under this Notice, groups or categories of data subject that the Company collects and processes personal data include:

3.1) Client, which means refers to individuals or legal entities that purchase products and/or utilize services from the company and/or may purchase products and/or utilize services from the company or similar entities. This includes participants in activities, training, website service users, individuals contacting the company for information or services, and respondents to surveys related to the company’s products and ‘or services.

3.2) Partners, distributors or those assigned by the Company, which means product sellers, contractors, and/or service providers, both juristic persons and persons to the Company

3.3) visitor, which means individuals who enter the company’s premiscs or inquire for information with the company.

4. How the Company collects and receives your personal data
4.1 The Company collects and receives your personal data through various channels as follows:
(a) personal data that you directly provide to the company

(1) When you communicate, ask for information, give opinions or criticism to the Company. May it be written or verbal communication, telephone, e-mail, fax, post, face-to-face or by any other means.

(2) When you show your intention to purchase the product, order or use services from the company, enter a contract with the Company or deliver documents which personal information appears to the Company

(b) personal data that the company automatically collected from you
The company may receive your personal data automatically, such as recording data via CCTV. (Closed-circuit television: CCTV) installed in the office building area and areas of various fields, collecting technical data, activities, and traffic patterns information about your browsing history automatically by using cookies and other similar technologies. You can learn more at “Cookies Notice” of the company.
(c) personal data that the company received from outsiders The Company may receive your personal data from third parties such as:

(1) Data collection from service providers of the company such as distributor or dealer etc.

(2) In some cases, the Company may collect your persona data from public sources, resources for your business or commercial resources whether you are the person who discloses personal data yourself or has given consent to anyone else to disclose your personal data.

4.2 In collecting your personal data, you will be informed of the details specified in this announcement, including but not limited to purposes and legal bases for collecting, using, disclosing, and/or processing personal data. If it is the case that the Personal Data Protection Law requires that any processing of personal data requires your consent, the Company will request your explicit consent.

4.3 If the Company has collected your personal data before the date the law on personal data protection regarding the collection, use, or disclosure of personal data comes into effect, the Company will continue to keep, collect, and use your personal data for the original purpose. You can withdraw your consent by contacting the Company using the contact details specified in clause11 of this Notice.

5. Personal data Collected

Your personal data that is collected and processed under this Notice, whether it is personal data that you provided directly to the Company or personal data that the Company has collected from you automatically, or personal data that the Company has received from outsiders, including:

5.1 Personal Information such as name, surname, email, job position, or data appearing on identification cards, etc.

5.2 Payment-related Information such as personal data visible on invoices, tax invoices, receipts, and payment vouchers.

5.3 Technical Data such as computer traffic data (logs), computer identification numbers (IP address), and information collected by the company through cookies or similar technologies.

5.4 Other Data such as still and motion images recorded through closed-circuit television (CCTV) cameras, etc.

The Company would like to inform you that in the event that the Company is required to request a copy of identification documents such as national identification cards and passports, which may contain sensitive personal data such as religion or blood group, the Company does not intend to collect such information. Please cross out or redact that part of the information. If you do not do so, the Company considers that you have permitted the Company to cross out or redact that information and that the document is complete and enforceable in all respects.

6. Purpose and legal basis for processing personal data

6.1 The Company processes your personal data for various purposes under the following legal bases (collectively, “Personal Data Processing Purposes”).

6.1.1 To enable the company to conduct business in accordance with its objectives (Contract), such as being necessary to fulfill contractual obligations with you or to use in carrying out your requests prior to entering such contracts, or for the purpose of facilitating the company’s business operations.

6.1.2 To fulfill legal obligations (Legal Obligation) in compliance with relevant laws, such as to comply with laws related to the company or to adhere to orders issued by legally authorized individuals, including but not limited to laws governing computers, tax laws (issuing tax invoices, receipts, and invoices), court orders, legal personnel, or other laws related to the company’s operations.

6.1.3 To carry out operations that are necessary for the legitimate interests, within the bounds reasonably expected by the data subject (Legitimate Interest), such as external contact monitoring through closed-circuit television (CCTV) recordings for controlling access to the premises, ensuring the safety of the company, its personnel, other individuals, as well as its assets and information.

6.1.4 It is necessary for performing tasks in the pursuit of the company’s public interests (Public Task) or for exercising the authority delegated to the company by the state.


6.1.6 Consent (Consent) When the company cannot rely on exemptions or legal bases as specified above, the company will seek explicit consent from you. In such cases, the company will process the a forementioned personal data for the stated purposes and in accordance with the consent received from you. In instances where the company processes sensitive personal data, the company will comply with legal requirements or obtain explicit and clear consent from you.

6.2 This is because the Company will process your personal data for the purposes specified in clause 6.1 above; where it is related to compliance with the law or contract or is necessary to enter into a contract with you, it is sufficient information to achieve such purposes. Suppose you wish to refrain from providing such personal data to the company. In that case, it may have legal consequences or may cause the company to be unable to perform its duties under the contract entered into with you or unable to enter into the contract with you (in some cases). In such cases, the Company may refuse to enter into a contract with you or provide related benefits or benefits to you, whether in whole or in part.

6.3 In the event that the Company will process your personal data in a manner and/or for a purpose that is not consistent with the purposes specified above, the Company will provide additional policy or notice regarding personal data protection to explain the data processing in such a manner. Please read additional related policies or notice with this Notice.

7. Disclosure of personal data
7.1 The Company may disclose your personal data for specified purposes and in accordance with legal criteria assigned to the following third parties:

(1) Business partners, service providers, distributor, or personal data processors appointed or engaged by the Company to manage/process personal data for various services provided to the Company.

(2) Consultants of the Company, such as legal consultants, attorneys, auditors, or other experts, both internally and externally affiliated with the Company.

(3) Government agencies responsible for regulatory oversight under the law or those requesting disclosure of personal data through legal authority, or those involved in legal processes, or authorized by relevant laws.

(4) Individuals or other organizations to whom you have given consent to disclose your personal data to those specific individuals or organizations.

7.2 Disclosure of your personal data to others will be done only for specified purposes or other purposes required by law. In cases where the law requires your consent, the Company will ask for your permission first.

7.3 In disclosing your personal data to other persons, the Company will provide appropriate measures to protect the personal data that has been disclosed and to comply with personal data protection standards and duties as specified by the Personal Data Protection Act. In this case, when the Company sending or transferring your personal data abroad, the Company will take steps to ensure that the destination country, international organization, or recipient of the data abroad has adequate standards of personal data protection or to ensure that sending or transferring your personal data abroad is by the criteria stipulated by the Personal Data Protection Act. In some cases, the Company may ask for your consent to send or transfer your personal data to such foreign countries.

8. Personal Data Retention Period

The company will retain your personal data for the period necessary to achieve the objectives specified in the Process personal data, the retention period of personal data will change depending on the purpose for which personal data is processed. In addition, the Company will retain personal data for the period required by relevant laws (if any) taking into account the legal statute of limitations for legal proceedings that may arise from or related to documents or personal information that the company collected in each item. And taking into account the practices of the company and of the relevant business sector for each type of personal data is important.

After the expiration of the a forementioned period, the Company will delete or destroy such personal data from storage or the company’s system and of other persons who provide services to the Company (if any) or making your personal information untrue can identify you Unless it is the case that the company Such personal data can be retained as required by the Personal Data Protection Law or other relevant laws. For more details on the retention period of your personal data, you can contact the company according to the contact details specified in Clause 11 of this notice.

9. Your Rights as Data Subject

As Data Subject, you have rights as specified by the Personal Data Protection Act, B.E. 2562 (2019). You can request to exercise your rights through the channels specified by the Company in clause 11. The rights are detailed as follows:

(a) Right to Withdraw Consent:
In the event that the Company asks for your consent, you have the right to withdraw your consent to process personal data that you have given consent to the Company unless the revocation of consent is limited by law or a contract that benefits you. (However, withdraw consent will not affect the lawful processing of personal data for which you have already given consent.)

(b) Right to Access Personal Data:
You have the right to request access and obtain a copy of your personal data, which is under the Company’s responsibility, including request the Company to disclose the acquisition of such personal data that you have not given consent to the Company.

(c) Right to Data Portability:
You have a right to request for sending or transferring of the Personal Data.

(d) Right to object to the collection, use, or disclosure of personal data:
You have the right to object to the processing of information about you in the case of collection, use, or disclosure of personal data about you as specified by law.

(e) Right to Erasure:
You have the right to request the Company to delete, destroy, or make personal data non-personally identifiable information as required by law.

(f) Right to Restriction of Processing:
You have the right to request the company to suspend the use of your information as required by law.

(g) Right to Rectification:
In the event that you consider that the information that the Company has is incorrect or you have changed your personal data, you have the right to request that the Company amend your personal data so that such personal data is correct, current, complete, and not misleading.

(h) Right to Lodge a Complaint:
You have the right to lodge a complaint to the official or authority in accordance with the Personal Data Protection Act B.E. 2562 if the Company violates or fails to comply with the PDPA.

10. Amendments to this Notification

The Company may amend and update this Notice from time to time. When such changes are made, the Company will notify you via the Company’s website and/or appropriate channels.

11. Contact

In the event that you have any questions or want additional details regarding the collection, use, or disclosure of personal data, exercising your rights, or having any complaints, you can contact the Company via the following channels:

Company name: Sumitomo Heavy Industries (Thailand) Ltd.
Address: Sumitomo Heavy Industries (Thailand) Ltd. 23rd Floor , Unit 2309-2310 Bhiraj Tower at Emquartier 689 Sukhumvit Rd., Klongton Nuea, Vadhana, Bangkok 10110
Telephone : 02-261-3720
Email :

Announced on 8 January B.E. 2567

Akira Yokota
Managing Director