Privacy Policy
Sumitomo Heavy Industries (Thailand) Ltd
Sumitomo Heavy Industries (Thailand) Ltd. (“Company”) has collected, used, and disclosed the personal data of customers, partners, employees, applicants, personnel, and any other persons related to the Company. The Company respects and recognizes the importance of the Personal Data Protection Act B.E. 2562. Therefore, the Company has created this Personal Data Protection Policy to be effective for all employees and personnel, including those involved in managing personal data to set guidelines and strictly adhere to the principles of processing personal data of the Company under appropriate criteria, regulations, and measures to ensure that personal data that the Company received will be used in accordance with regulations and in compliance with the law regarding personal data protection, with the following details:
1. Definition
“Company”
means Sumitomo Heavy Industries (Thailand) Ltd.
“Personal Data”
means any information relating to a Person, which enables the identification of such person, whether directly or indirectly, but not including the information of the deceased Persons in particular.
“Sensitive Personal Data”
means Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee.
“Personal Data Controller”
means a person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data.
“Personal Data Processor”
means a person or a juristic person who operates in relation to the collection, use, or disclosure of the Personal Data pursuant to the orders given by or on behalf of a Data Controller.
“Data subject”
means the natural person to whom the information refers.
“Data processing”
means any operation concerning the collection, use, and disclosure of personal data.
2. Purpose and collection of use of personal data
2.1 The Company will collect and/or use personal data as necessary or as relevant to the purpose of collecting or using such personal data and will not collect any other personal data that is not relevant.
2.2 The Company will collect and/or use personal data only for the specified personal data processing purposes and will not use such data for other purposes. If the Company takes any action other than the specified purposes, the Company will notify the Data subject and obtain consent if necessary.
2.3 In the event that the Company collects and/or uses personal data, the Company will first request consent from the Data subject, unless it is an exception under the Personal Data Protection Act that can be done without such consent.
2.4 The Company will not collect personal data regarding race, ethnicity, political opinions, religious beliefs, religion or philosophy, sexual behavior, criminal history, health information, disability, trade union information, genetic information, biological information, or any other information that affects the Data subject in the same way unless express consent is obtained from the Data subject only or falls under an exception as stipulated by the Personal Data Protection Law, where consent is not required. The Company will collect and use such personal data with caution under appropriate security standards.
2.5 The Company will comply with personal data protection laws by considering the importance of the security of personal data, not using information obtained from work for other purposes, or causing damage to the Company.
3. Processing of personal data by third parties
The Company may need to send or transfer personal data to third parties or agencies for processing. The Company will supervise the sending or transfer of personal data in accordance with the law and will carry out measures to protect personal data that are considered necessary and appropriate in accordance with confidentiality standards, such as separating data before sending personal data, delivering data only as needed, including having a confidentiality agreement or Data Processing Agreement with the recipient of such information.
4. The submission or transfer of personal data to foreign countries
The Company may need to send or transfer personal data to companies in the Company’s network overseas or to other recipients as part of the Company’s normal business operations, such as sending or transferring personal data to be stored on servers or clouds in different countries, the Company will take into account and consider whether the destination country has been certified to have adequate personal data protection standards.
In the event that the destination country does not have adequate standards, the Company will oversee the sending or transfer of personal data in accordance with the law. It will implement measures to protect personal data that are considered necessary and appropriate by the standards of confidentiality unless it falls into an exception according to the personal data protection law. In cases where the destination country has insufficient standards, the transfer of personal data abroad can still be carried out if it is an exception in the case of compliance with the law, obtaining consent from the Data subject necessary for the performance of the contract, prevents danger to life or is required for the public interest.
5. Personal Data Retention Period
The Company will retain personal data for the period necessary to process the purpose or for the period needed to achieve the purpose unless there is a law or court order requiring the Company to store such personal data as specified, such as stored for verification purposes in the event of a dispute within the statute of limitations set by law for a period not exceeding 10 years.
The Company will delete or destroy personal data or make it non-personally identifiable information when it is no longer necessary or at the end of the period.
6.Maintaining Security
6.1 The Company will provide appropriate measures to maintain the security of personal data, including technical measures such as setting passwords, encryption (Secure Sockets Layer/SSL), network equipment security system, and organizational measures, setting information security policy, maintaining confidentiality, and defining access rights. Such measures are strictly enforced and regularly reviewed and improved when technology changes to be effective in maintaining security and preventing personal data violations, loss, access, destruction, use, change, modification, misuse of data, or disclosure of personal data.
7. Personal data breach
In the event of a personal data breach, the Company will notify the Office of the Personal Data Protection Commission within 72 hours from when the Company becomes aware of the personal data breach or in cases where the violation of personal data is at high risk of affecting the rights and freedoms of the Data subject; the Company will notify the Data subject of the offense along with remedies for such breach without delay.
8. Data subject’s Rights
The rights of the Data subject are legal rights that the Data subject can request to exercise various rights under the provisions of the law, and the Company will process the Data subject’s request without delay. However, if there is a case where the Company must reject the request, the Company will inform the Data subject of the reason for the refusal.
8.1 Right to Withdraw Consent Suppose the Data subject has given consent to the Company to collect, use and/or disclose personal data (Whether it is consent given by the Data subject before the effective date of the Personal Data Protection Law or afterward). In that case, the Data subject has the right to withdraw consent at any time throughout the period that personal data is with the Company, unless such rights are restricted by law or a contract benefits the Data subject. The Company will notify the Data subject of the possible consequences of withdrawing such consent.
8.2 Right to request access to personal data The Data subject has the right to request access to or obtain a copy of his or her data that is under the Company’s responsibility, including requesting the Company to disclose the acquisition of such personal data that the Data subject has not consented to. The Company has the right to refuse a request if it is in accordance with the law or court order or if accessing or requesting a copy affects the rights and freedoms of others.
8.3 Right to request personal data portability The Data subject has the right to request personal data in cases where the Company has prepared that personal data in a format that can be read or used by a tool or device that works automatically and can use or disclose the personal data by automatic method, including the right to request the Company to send or transfer personal data in such form to another data controller when this can be done by automated means and have the right to request personal data that the Company sends or transfers personal data in such form directly to other personal data controllers, unless unable to do so due to technical reasons.
However, the above personal data must be personal data that the Data subject has given consent to the Company to collect, use, and/or disclose or is personal data that the Company needs to collect, use, and/or disclose in order to be able to proceed according to contract as desired or as other personal data as specified by the legal authority.
8.4 Right to object to the collection, use, and disclosure of personal data. Data Subjects have the right to object to the collection, use and/or disclosure of personal data at any time if it is personal data collected without consent, for direct marketing purposes, or scientific research or statistics. The Company can reject the request if necessary for the Company’s public interest mission, or in cases where the Company demonstrates a more important legitimate cause, or to establish an exercise of rights to demand Compliance with the law.
8.5 Right to request deletion or destruction of information Data subjects have the right to request deletion or destruction of personal data or make personal data non-personally identifiable if the Data subject believes that personal data has been collected, used and/or disclosed in violation of relevant laws or considers that the Company does not need to keep it for the purposes related to this policy, or when the Data subject has exercised the right to withdraw consent or has exercised the right to object as informed above.
8.6 Right to Restriction of Processing Data subjects have the right to request a temporary suspension of using personal data if the Company is currently investigating requests to exercise the right to correct personal data or to object, or any other cases where the Company has no need and must delete or destroy personal data in accordance with relevant laws.
8.7 Right to Rectification Data subject have the right to ensure that the Personal data remains accurate, up to date, complete, and not misleading.
9. Penalties
A person who is responsible for carrying out a particular matter according to his or her duties, if he or she neglects or neglects to give orders or does not carry out or give orders, or carry out any action in the performance of their duties in violation of the policy and practice manual regarding the management of personal data to the point of causing legal wrongdoing and/or damage, that person will be subject to disciplinary punishment according to Company regulations. In this regard, if the said offense causes damage to the Company and/or any other person, the Company may consider further legal action.
10. Compliance with the Policy and Policy Review
Announced on 8 January B.E. 2567
Akira Yokota
Managing Director