-1 152
1 Day Satisfaction Project
One day Satisfaction Project
PERSONAL DATA PRIVACY NOTICE OF CHAROEN POKPHAND GROUP COMPANY LIMITED
1. General Provisions
For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendments which may be made thereto, (“Laws on Personal Data Protection”), Charoen Pokphand Group Company Limited (“Company”) has prepared this personal data privacy notice (“Privacy Notice”) to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”), for instance, the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, alignment, combination, prohibition of access or restriction, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:
2. The Categories of Persons whom the Company Collects Personal Data and the Sources of Personal Data
2.1 Under this Privacy Notice, the categories of persons from whom the Company collects and Processes Personal Data and the source of such Personal Data are as follows:
Category Details Sources of Personal Data
(a) Customers Persons who purchase products and/or use the services of the Company and/or those who are expected to purchase products and/or use the services of the Company (prospective customers), or any other persons having similar characteristics such as persons who participate in activities, seminars, or bids, website users, application users, persons who make contact to request to receive information or services from the Company, and persons who provide responses to surveys concerning products and/or services of the Company, etc. They shall also include persons who are related to or are representatives of customers who are juristic persons and persons whose Personal Data appear in the relevant documents and processes. Please see further details in the Privacy Notice for processes relating to customers of CP Group Company Limited.
Please see further details in the Privacy Notice for processes relating to customers of CP Group Company Limited.
  • When you engage in communications, make enquiries or complaints through the website or application, by phone, e-mail or by face-to-face interaction or by any other means.
  • When you express an intention to purchase products or use services of the Company and enter into a contract with the Company
  • When you participate in marketing activities, lucky draws, events or any other activities.
  • Collection of data from the service providers of the Company, such as application service providers and service providers for public relations and products/services recommendation.
  • In some cases, the Company may collect your Personal Data from public sources, irrespective of whether you have disclosed the Personal Data by yourself or have provided consent to somebody else to disclose such Personal Data.
(b) Vendors Persons who provide quotations for products and/or services to be sold to the Company or have any other relationships of a similar nature with the Company, such as service providers, consultants, experts, academics, lecturers, participants in business projects, contracting parties or any other persons having similar characteristics, etc. They shall also include natural persons who are related to or act as representatives of the vendors who are juristic persons and persons whose Personal Data appear in the relevant documents and processes.
Please see further details in the Privacy Notice for processes relating to vendors of CP Group Company Limited.
  • When you fill in forms through the Company’s website or by any other means.
  • When you enter into a contract with the Company and submit documents containing your Personal Data to the Company.
  • When you make enquiries, provide comments or suggestions, or report complaints to the Company by phone, e-mail or any other means.
  • In some cases, the Company may collect your Personal Data from public data sources, sources containing information relating to your business or sources containing information relating to trades, irrespective of whether you have disclosed the Personal Data by yourself or have provided consent to somebody else to disclose such Personal Data.
(c) Directors and personnel Persons who work or perform any duties for the Company and receive salary, wages, welfare benefits or any other compensation from the Company, irrespective of what such compensation is called, such as directors, executives, managers, employees, personnel, trainees or any other persons having similar characteristics. They shall include persons related to the directors and personnel of the Company and persons whose Personal Data appear in the relevant documents and processes, such as family members, reference person, and persons who may be contacted in case of emergency, etc. Please see further details in
• the Privacy Notice for processes relating to the directors of CP Group Company Limited.
• the Privacy Notice for processes relating to the personnel of CP Group Company Limited.
  • When you enter into an employment contract or any other contracts having similar characteristics with the Company.
  • When you submit documents containing your Personal Data to the Company for use as supporting evidence for the execution of contracts or juristic acts with the Company.
  • In some cases, the Company may collect your Personal Data due to your status as a family member, a person who may be contacted in case of emergency, a beneficiary or a guarantor by the Company’s personnel.
(d) Job applicants Persons who may be selected to be personnel of the Company. They shall include persons relating to the job applicants and persons whose Personal Data are contained in the documents relating to the job applications, such as family members, reference person, and persons who may be contacted in case of emergency, etc. The Company may directly collect Personal Data of the job applicants by itself or obtain the Personal Data from a third party.
  • When you submit a job application and supporting documents to the Company on a walk-in basis, by submission at a booth for job applications, or through the Company’s website.
  • When you have an interview with the Company.
  • The Company may receive your Personal Data from a third party’s website, your reference person, recruitment companies, governmental authorities, educational institutions, or social media sources, irrespective of whether you have disclosed the Personal Data by yourself or have provided consent to somebody else to disclose such Personal Data.
(e) General public Any person who does not fall into the above categories of persons whose Personal Data is Processed by the Company, irrespective of whether such Personal Data is directly received by the Company, automatically collected through the use of Cookies or other technologies, or provided by a third party. An example of such person includes a person whose image is recorded by CCTV or who accesses the Company’s website, etc.
  • When your image or video is recorded by CCTV which is controlled by the Company
  • When you intentionally or unintentionally access the Company’s website
2.2 In some cases, the Company may collect your Personal Data by automated means such as the use of Cookies or other similar technologies. For more details, please see the Company’s Cookie Policy
2.3 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to, the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request your explicit consent.
2.4 Where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. In this regard, you have the right to withdraw your consent by contacting the Company using the contact details set out in Clause 8 of this Privacy Notice. However, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.
3. Collected Personal Data
Your Personal Data that is collected and Processed under this Privacy Notice, regardless of whether such Personal Data was directly provided by you to the Company or automatically collected from you by the Company, or was provided to the Company by third parties, includes the following:

3.1 Personal information, such as first name, last name, date/month/year of birth, age, sex, weight, height, national identification number, photograph, signature, nationality, race, religion, marital status, military status, information concerning family members (such as father, mother, spouse and child), health conditions, biometric data (such as finger print, palm print and facial simulation), etc.

3.2 Contact information, such as address as stated on the national identification card, address as stated in the house registration book, delivery address, billing address, telephone number, fax number, e-mail, Line ID, person who may be contacted in case of emergency, and details of reference person, etc.

3.3 Business information, such as details concerning the customer’s factory (such as name, registration number, location, contact details), terms of trade, etc.

3.4 Information concerning sale and purchase transaction, such as vendor code, details of the wishlisted product, details of delivery, account number and monetary amount, etc.

3.5 Information concerning payment, such as the monetary amount, the credit limit, the payment terms, the account number, Personal Data which appears in the tax invoice, cheque and cheque stub, payment voucher, receipt, receipt voucher and debit application form, etc.

3.6 Information that is used as supporting evidence of the execution of transactions and juristic acts, such as Personal Data which appears in a copy of the national identification card, copy of passport, copy of house registration book, copy of change of name certificate, copy of factory license, registration form, copy of documents of title over land, customer’s account opening form, document certifying non-related party, power of attorney, company affidavit, PhorPor. 09/20, map, security documents (such as title deed, bank guarantee, personal guarantee), sale and purchase agreement or any other agreement relating to the transaction, delivery order, copy of lawyer’s license, professional license or business license, copy of military service certificate, copy of bank account book, copy of marriage certificate, copy of birth certificate, form for approval of salary of new staff and monthly staff, medical certificate, result of pre-employment medical check, form for specifying beneficiary, social security application form, letter of consent for personal background check, result of personal background check, employment contract, letter of guarantee for performance of employment contract and related documents (such as certificate of employment specifying job position, copy of civil servant card, certificate of employment specifying salary, copy of business registration, or document on the incorporation of the company containing the name of the guarantor for performance of employment contract as the owner or partner, etc.), directorship agreement and power of attorney, etc.

3.7 Information on education and training, such as academic and training background (such as name of educational institution, program, and year of graduation), academic certificate, transcript, language skills, computer skills, details on training and tests, activities participated in during the time of study, etc.

3.8 Information on job application, such as personal background, history of employment, details which appear in resume/CV, criminal record, position that is being applied for, expected salary, information on job interview, evidence or letter being referred to, and information which appears in the interview assessment (such as assessment result, knowledge and experience, personal characteristics, team work, and ability), etc.

3.9 Information on work and assessment, such as personnel code, position, department, affiliation, chain of command, performance assessment, working behavior, achievement and/or award received, training information, disciplinary action information, details which appear in personnel transfer document of the Company, personnel on loan contract, letter of resignation, and reason for the resignation, etc.

3.10 Information on benefits and remuneration, such as salary, wages, reward, bonus, pension details, welfare, bank account number, guarantor’s details, beneficiary’s details, social security details, provident fund details, tax details, tax deduction details, health benefit details (including for family member) and/or other benefits, Personal Data which appears in medical certificates, annual health reports, maternity leave forms, welfare money lending forms, salary reduction consent letters, receipts, invoices, compensation request forms (for accident and life insurance) and retirement benefit request forms, etc.

3.11 Information on registration statistics, such as starting date, probation end date, working date and time, hours of work, hours of overtime work, annual leave, leave date, leave form, leave details including reasons for such leave, the Company entry and exit record, and usage record of systems of the Company, etc.

3.12 Technical information, such as a log file, IP Address, and information that the Company collects through the use of Cookies or other similar technologies, etc.

3.13 Other information, such as voice recording of conversations, and photo and video recording by means of CCTV, any information that you sent to us for the website connecting such as comment and your location etc.

4. Purposes and Lawful Basis for the Collection, Use, Disclosure and Processing of Personal Data
4.1 The Company Processes your Personal Data for the following purposes and lawful basis (collectively, the “Purposes”):
No. Purposes Lawful basis of the Processing
A. For a purpose relating to selling products and services to customers and other relevant transactions
(1) For membership registration or customer account opening
  • Contractual basis: The Processing of Personal Data of customers is necessary to act in accordance with the customer’s request in respect of the registration of new customer or customer account opening.
  • Legitimate interest basis: Where the customers are juristic persons, the Processing of Personal Data of persons related to the customers is necessary for the legitimate interests of the Company in its business operations.
(2) For entering into agreements for sale and purchase of products and services
  • Contractual basis: The Processing of Personal Data of customers is necessary for the entry into agreements and other relevant processes.
  • Legitimate interest basis: Where the customer is a juristic person, the Processing of Personal Data of persons related to the customers is necessary for the legitimate interests of the Company in its business operations, such as the management of contracts, verification of the identity of customers, and consideration of the qualifications of customers.
(3) For management of customer orders, preparation of products and/or services, and other relevant transactions
  • Contractual basis: The Processing of Personal Data of customers is necessary for the performance of obligations in a sales and service agreement to which the customer is a party, such as arranging shipments of products, billing, confirmation of outstanding debt, and the delivery of receipts to the customers, etc.
  • Legitimate interest basis: Where the customer is a juristic person, the Processing of Personal Data of persons related to the customer is necessary for the legitimate interests of the Company in its business operations.
(4) For changing information relating to customers and receiving complaints
  • Legitimate interest basis: The Processing of Personal Data of customers is necessary for the legitimate interests of the Company in facilitating customers to edit their information in order to make it accurate, up-to-date, complete, so as not to cause any misunderstanding, and for the improvement of the Company’s services in the case of any complaints or suggestions from the customer.
B. For a purpose relating to procurement with vendors, using services of service providers and other relevant transactions
(1) For procurement and the selection of vendors or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data is necessary for carrying out requests for quotation by vendors, or any other persons having similar characteristics, before entering into a sales agreement, service agreement, or any other agreement relating to procurement by the Company.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in its business operations and for compliance with the Company’s procurement policy.
(2) For registering new vendors or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data is necessary for carrying out the request of prospective vendors or any other persons having similar characteristics for the new vendor registration, including any other relevant transactions.
  • Legitimate interest basis: Where the vendor is a juristic person, the Processing of Personal Data of any person related to the vendor is necessary for the legitimate interests of the Company in its operations.
(3) For execution and management of agreements between the Company and any other contractual parties
  • Contractual basis: The Processing of Personal Data of the contractual party is necessary for carrying out the request of such party who has expressed the intention to enter into an agreement with the Company.
  • Legitimate interest basis: The Processing of Personal Data of the contractual party (or any person related to the contractual party, in the event where the contractual party is a juristic person) is necessary for the legitimate interest of the Company in the execution and management of the Company’s agreements.
(4) For performing obligations under agreements made with vendors or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data is necessary for performing obligations under agreements made with vendors or any other persons having similar characteristics, such as ordering products or services, settling debt, paying for products or services, and receiving products or services, etc.
C. For a purpose relating to communications and marketing
(1) For communicating with you.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interest of the Company in communicating with you regarding the Company’s products and services.
(2) For public relations and marketing activities of the Company.
  • Consent basis: Where the Company proceeds with marketing activities, such as sending marketing messages to you, taking photographs or recording video of you in order to process and publicize marketing activities through various channels, the Company will undertake the activities by relying on the consent received from you.
D. For a purpose relating to the analysis of information and the improvement of the quality of the products and services of the Company
(1) For analyzing your use of websites, applications, or other media.
  • Legitimate interest basis: The Processing of your Personal Data from the use of websites, applications, or other media is necessary for the legitimate interests of the Company in its business operations and improvement of quality of services.
  • Consent basis: Where the Company collects and Processes your Personal Data in order to analyze your behavior and specifically advertise according to your behavior, the Company will undertake such actions by relying on the consent received from you.
E. For a purpose relating to human resource management
(1) For recruitment, job applicant selection, interview, and any transactions in relation to the recruitment process.
  • Contractual basis: The Processing of the Personal Data of job applicants is necessary for consideration of their request to apply for a job and enter into the Company’s recruitment process.
  • Legitimate interest basis: The Processing of Personal Data of the job applicants or persons related to the job applicants is necessary for the legitimate interests of the Company in its recruitment process and selection of employees.
  • Consent basis: The Processing of your Personal Data as a reference person of the job applicants will be relying on the consent received from you.
  • Consent basis: The Company collects Personal Data of prospective personnel by the Company’s own initiative, from third parties, such as recruiters via website(s), whereby the prospective personnel have not expressed their intention to apply for a job with the Company.
(2) For any other processes in relation to employment such as conducing medical check-ups before commencement of the job, criminal record check, and entering into an employment contract, etc.
  • Contractual basis: The Processing of Personal Data of personnel is necessary for the entry into an employment contract and other relevant contracts, including undertaking any processes necessary before entering into such contracts.
  • Legitimate interest basis: The Processing of the Personal Data of personnel is necessary for the Company in its human resources management, such as verifying and considering the personnel’s qualifications in order to identify the appropriate position for the personnel, etc.
  • Consent basis: The Processing of sensitive Personal Data, such as criminal records, health information and biometric information will be based on the consent received from the personnel.
(3) For management of welfare and benefit of directors and personnel, including but not limited to welfare money loan, medical expense reimbursement, discounts for directors and personnel, annual physical examination, insurance, and claims related to insurance
  • Contractual basis: The Processing of Personal Data of directors and personnel is necessary for the Company to perform its obligations according to the employment contracts and any other contracts to which the directors or personnel is a contracting party (as the case may be).
  • Legitimate interest basis: The Processing of Personal Data of directors and personnel and persons related to the directors and personnel is necessary for the Company in its human resources management, such as allocation of welfare and benefit for the directors and personnel and persons related to the directors and personnel.
  • Consent basis: The Processing of sensitive Personal Data of directors and personnel and persons related to the directors and personnel, such as health information, for the management of group insurance and other benefits, will be undertaken by relying on the consent received from the directors and personnel and persons related to the directors and personnel.
(4) For the purpose of the performance of duty of directors and personnel according to the employment contract, employment agreement, appointment contract, or any other contracts entered into with the Company (as the case may be)
  • Contractual basis: The Processing of Personal Data of relevant directors and personnel is necessary for the performance of duty or work according to the scope work specified in the employment contract, employment agreement, appointment contract, or any other contacts to which the directors or personnel and the Company are contracting parties (as the case may be).
  • Legitimate interest basis: The Processing of Personal Data of directors and personnel is necessary for the legitimate interests of the Company in its business operation and compliance with the applicable laws of the Company.
(5) For the purpose of salary payment, bonus, remuneration or any other benefits
  • Contractual basis: The Processing of Personal Data of directors and personnel is necessary for the payment of wages, salary, bonus, remuneration and/or any other benefits according to the employment contracts and any other contracts to which the directors and personnel is a contracting party (as the case may be).
  • Legal basis: In some cases, the Processing of Personal Data of the directors and personnel and persons related to the directors and personnel is the performance in compliance with the applicable laws of the Company, such as withholding tax pursuant to the taxation laws, etc.
(6) For the purpose of the management of training personnel
  • Legitimate interest basis: The Processing of Personal Data of personnel is necessary for the legitimate interests of the Company in its training management, such as training registration, preparation of action plan, and allocation of appropriate facilities for the training, etc.
F. For the purpose of compliance with relevant laws which are applicable to the Company and for the establishment of legal claims
(1) For compliance with relevant laws which are applicable to the Company.
  • Legal basis: The Processing of Personal Data is necessary for compliance with laws which are applicable to the Company such as, Laws on Personal Data Protection, taxation laws, labour laws, social security laws, civil and commercial laws, public company laws, securities and exchange laws, etc.
(2) For the establishment of legal claims and any other relevant proceedings.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the establishment, compliance, exercise or defense of legal claims in various stages according to the law, such as, investigation and inquiry by government officials, case preparation, prosecution, and pursuit of the case in court, etc.
G. For the purpose relating to security
(1) For monitoring, protecting and ensuring the security of persons and properties of the Company and the general public.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in monitoring, protecting and ensuring the security of properties of the Company and the general public. For example, the CCTV footages can be used to prevent loss or damage to the Company’s properties and the general public.
  • Preventing or suppressing danger to a person’s life, body, or health basis: The Processing of Personal Data is necessary for the benefit in monitoring, preventing, or suppressing any circumstances which may be dangerous to a person’s life, body, or health.
H. Any activities that are necessary and beneficial to you and any other purposes
(1) For any transaction that is necessary and beneficial to you or those which are directly related to the purposes set forth above.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in carrying out any transactions which are necessary for the Company and/or beneficial to you or directly related to the purposes set forth above. Where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
(2) For other purposes that the Company will notify you of.
  • The Company will notify you of any other purposes that cause the Company to Process your Personal Data other than the purposes set forth above or when the Company changes the original purposes that were set forth. Where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
4.2 Your Personal Data, which the Company will Process for the Purposes set forth in Clause 4.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or the provision of any relevant services to you, whether in whole or in part.
4.3 In the event that the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send a notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case may be).
5. Disclosure of Personal Data
5.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following entities and persons:
  • (a) Charoen Pokphand Group, in and outside Thailand, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.
  • (b) Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services, such as personnel’s physical examinations by business partners, information technological services, data recording services, payment services, mailing services, delivery services, printing services, health services, insurance services, training services, data analysis services, research services, marketing services, or any other services which may be beneficial to you or relevant to the Company’s business operations, such as commercial banks, hospitals, life insurance companies, and non-life insurance companies, etc.
  • (c) Advisors of the Company, such as legal advisors, lawyers, auditors, or any other internal and external experts of the Company, etc.
  • (d) Relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission pursuant to applicable laws, such as the Department of Labour Protection and Welfare, Department of Skill Development, Department of Empowerment of Persons with Disabilities, Social Security Office, Department of Provincial Administration, Department of Business Development, Department of Intellectual Property, Office of the Personal Data Protection Commission, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, court, and Legal Execution Department, etc.
  • (e) Customers, vendors, contracting parties of the Company which you have contacted or are relevant to your duty or position, or any other person in similar manners.
  • (f) Any persons or other entities that you have given consent to disclose your Personal Data to, such as the disclosure of processed images of activities through various media platforms of the Company to the general public.
5.2 The disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by law, provided that if the law requires your consent to be provided, the Company will request your prior consent.
5.3 In the event that the Company discloses your Personal Data to third parties, the Company will put in place appropriate safeguards to protect the Personal Data that has been disclosed and to comply with the standards and duties relating to the protection of Personal Data as prescribed by the Laws on Personal Data Protection. Where the Company sends or transfers your Personal Data outside Thailand, the Company will ensure that the recipient country, the international organization or such overseas recipient has a sufficient standard for the protection of Personal Data. In some cases, the Company may request your consent for the transfer of your Personal Data outside Thailand, subject to the requirements under Laws on Personal Data Protection.
6. Retention Period
The Company will retain your Personal Data for the period necessary to fulfil the Purposes for which the Personal Data was Processed, whereby the retention period will vary depending on the Purposes for which such Personal Data was collected and Processed. The Company will retain Personal Data for the period prescribed under the applicable laws (if any) by considering the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the documents or Personal Data collected by the Company and having regard to the Company’s business practices and relevant business in relation to each category of Personal Data.
In this regard, the Company will retain your Personal Data for a period not exceeding 10 years, starting from the date your legal relations/transactions with the Company come to an end. However, the Company may retain your Personal Data for a longer period of such time prescribed if the laws permit or such retention of Personal Data is necessary for the establishment of the right of claim of the Company.
After the period of time set forth above has expired, the Company will delete or destroy such Personal Data from the storage or system of the Company and other persons providing services to the Company (if any) or anonymize your Personal Data, unless in the event that the Company can continue to retain such Personal Data as prescribed by the Laws on Personal Data Protection or other applicable laws. In this regard, for additional details regarding the retention period of your Personal Data, you can contact the Company by using the contact details set out in Clause 8 of this Privacy Notice.
7. Your Rights in relation to Personal Data
As the data subject, you have the following rights in relation to your Personal Data, subject to the rules, methods and conditions under the Laws on Personal Data Protection. In this regard, if you wish to make a request to exercise your rights, you can contact the Company by using the contact details set out in Clause 8.of this Privacy Notice.

7.1 Right of Access You have the right to access your Personal Data and may request that the Company provide you with a copy of such Personal Data in accordance with the requirements under the Laws on Personal Data Protection.

7.2 Right to Data Portability You have the right to obtain your Personal Data, including to request that your Personal Data is transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements under the Laws on Personal Data Protection.

7.3 Right to Object You have the right to raise an objection to the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

7.4 Right to Erasure You may request that the Company delete, destroy or anonymize your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

7.5 Right to Restriction You have the right to request that the Company restrict the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

7.6 Right to Rectification You have the right to request that your Personal Data be rectified if the Personal Data is inaccurate, not up-to-date or incomplete, or may cause a misunderstanding.

7.7 Right to Withdraw Consent If the Company relies on your consent as the legal basis for Processing your Personal Data, you have the right to withdraw such consent which has been provided to the Company at any time.

7.8 Right to Lodge a Complaint If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 8 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Committee in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

However, the Company reserves the right to consider your request to exercise your rights and act in accordance with the requirements under the Laws on Personal Data Protection.

8. How to Contact the Company
The Company has designated Charoen Pokphand Group Company Limited as the coordinator for matters relating to the Company’s Personal Data protection. If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact information provided below:
Data Protection Officer
E-mail:
cpgroup_compliance@cp.co.th
Address:
Corporate Compliance Office, Charoen Pokphand Group Company Limited
1 Fortune Tower, 17th Floor, Ratchadaphisek Road, Din Daeng, Din Daeng, Bangkok 10400
9. Changes to This Privacy Policy
The Company may make changes to this Privacy Policy from time to time to reflect any changes to our Processing of your Personal Data and to comply with any changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Policy and the amended Privacy Policy through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Policy from time to time.
Document No. CPG-001-FM-CCO-PDPA-TH-01-20220531
This Privacy Policy shall be effective from1 June 2022
PERSONAL DATA PRIVACY NOTICE FOR PROCESSES RELATED TO CUSTOMERS OF CHAROEN POKPHAND GROUP COMPANY LIMITED
1. General Provisions
For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendments which may be made thereto, (“Laws on Personal Data Protection”) Charoen Pokphand Group Company Limited (“Company”) has prepared this Personal Data Privacy Notice for processes related to customers of Charoen Pokphand Group Company Limited (“Privacy Notice”) to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”), such as the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, alignment, combination, prohibition of access or restriction, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:
2. Groups or Categories of Persons whom the Company Collects Personal Data
Under this Privacy Notice, groups or categories of persons from whom the Company collects and Processes Personal Data are as follows:

2.1 Customers which means persons who purchase products and/or use services of the Company and/or those who are expected to purchase products and/or use the services of the Company (prospective customers), or any other persons having similar characteristics, such as persons who participate in activities, seminars, or bids, website users, application users, persons who make contact to request to receive information or services from the Company, and persons who provide responses to surveys concerning products and/or services of the Company, etc.

2.2 Persons related to customers which means persons who are related to or are representatives of customers, such as executives, directors, employees, representatives, or personnel of customers who are juristic persons, including persons whose Personal Data appear in relevant documents and processes, such as managers, purchasers, consignees, and cheque payers, etc.

3. How the Company Collects and Receives your Personal Data
3.1 The Company collects and receives your Personal Data via the following methods:
  • (a) Personal Data which you directly provide to the Company
    You may directly provide your Personal Data to the Company, such as
    • When you engage in communications or make enquiries, provide comments or feedbacks to the Company, regardless of whether in written or oral communications through the website, application, by phone, e-mail, fax, mail, by face-to-face interaction or by any other means;
    • When you express an intention to purchase products or use services of the Company, enter into a contract with the Company, or deliver documents containing Personal Data to the Company; and
    • When you participate in marketing activities, lucky draws, events or any other activities organized by or on behalf of the Company, etc.
  • (b) Personal Data which the Company automatically collects from you
    The Company may collect your Personal Data by automated means such as the use of Cookies or other similar technologies. For more details, please see the Company’s Cookie Policy
  • (c) Personal Data which the Company receives from third parties
    The Company may receive your Personal Data from third parties, such as
    • The collection of information from various service providers of the Company, such as website service providers, application service providers, service providers for public relations and products/services recommendation, and data collection service providers, etc.
    • In some cases, the Company may collect your Personal Data from public data sources, data sources containing information relating to your business, or sources containing information relating to trades, irrespective of whether you have disclosed the Personal Data by yourself or have provided consent to somebody else to disclose such Personal Data.
3.2 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to, the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request your explicit consent.
3.3 Where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. In this regard, you have the right to withdraw your consent by contacting the Company using the contact details set out in Clause 9 of this Privacy Notice. However, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.
4. Collected Personal Data
Your Personal Data that is collected and Processed under this Privacy Notice, regardless of whether such Personal Data was directly provided by you to the Company or automatically collected from you by the Company, or was provided to the Company by third parties, includes the following:

4.1 Personal information, such as first name, last name, nickname, date/month/year of birth, age, sex, national identification number, photograph, and signature, etc.

4.2 Contact information, such as address as stated on the national identification card, address as stated in the house registration book, delivery address, billing address, telephone number, fax number, e-mail, Line ID, and details of person who may be contacted in case of emergency, etc.

4.3 Customer business information, such as type of business, details concerning the customer’s factory (such as name, registration number, location, and contact details, etc.), car number plate and type of car, and term of trading, etc.

4.4 Information concerning payment, such as the monetary amount, the credit limit, the payment terms, the account number, Personal Data which appears in the invoice, tax invoice, receipt, receipt voucher, and debit application form, etc.

4.5 Information that is used as supporting evidence in the Company’s customer registration or execution of transactions, such as Personal Data which appears in a copy of the national identification card, copy of passport, copy of house registration book, copy of change of name certificate, copy of factory license, registration form, copy documents of title over land, customer’s account opening form, documents certifying non-related parties, power of attorney, copy of company affidavit, copy of PhorPor. 09/20, map, security documents (such as title deed, bank guarantee, and personal guarantee), sale and purchase agreement or any other agreements relating to the transaction, and delivery order, etc.

4.6 Technical information, such as log file, IP Address, and information that the Company collects through the use of Cookies or other similar technologies, etc.

4.7 Other information, such as voice recording of conversations, and photo and video recording by means of CCTV, etc.

5. Purposes and Lawful Basis for the Collection, Use, Disclosure and Processing of Personal Data
5.1 The Company Processes your Personal Data for the purposes under lawful basis as follows (collectively, the “Purposes”):
No. Purposes Lawful basis of the Processing
(a) For the purpose of selection of bidders in the product selling of the Company and any management related to the auction
  • Legitimate interest basis: The Processing of Personal Data of bidders or persons related to the bidders (in case bidders are juristic persons) is necessary for the legitimate interests of the Company in its auction management and related process, such as bidder qualification considerations, communications, auction summary, and evidence collection in relation to the winning bidders, etc.
  • Contractual basis: The Processing of Personal Data of bidder is necessary for the entering into a contract with bidder in case of winning, including buying and selling of products with the winning bidder, etc.
(b) For the purpose of entering into agreements and providing collateral
  • Contractual basis: The Processing of Personal Data of customers or any other persons having similar characteristics is necessary for the entry into agreements and other relevant processes, such as checking of evidence for the entry into agreements, consideration of credit limit, and providing collateral, etc.
  • Legitimate interest basis: Where the customers or any other persons having similar characteristics are juristic persons, the Processing of Personal Data of persons related to the customers or any other persons having similar characteristics is necessary for the legitimate interests of the Company in its business operations, such as the management of contracts, verification of the identity of customers, consideration of the qualifications of customers, etc.
(c) For the purpose of management of customer orders or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data of customers or any other persons having similar characteristics is necessary for the performance of obligations in a sales and service agreement to which the customer or any other persons having similar characteristics is a party, such as purchase via any means whether directly by the Company’s method or third parties’ method, such as via website or other means, etc.
  • Legitimate interest basis: Where the customer or any other persons having similar characteristics are juristic persons, the Processing of Personal Data of persons related to the customers or any other persons having similar characteristics is necessary for the legitimate interests of the Company in its business operations, such as management of customer’s order, and verification of the identity of customers, etc.
(d) For the purpose of product and/or service preparation and other relevant transactions
  • Contractual basis: The Processing of Personal Data of customers or any other persons in similar manners is necessary for the performance of obligations in agreements to which the customer or any other persons having similar characteristics is a party, such as arranging shipments of products, billing, confirmation of outstanding debt, and delivery of receipts to the customers or any other persons in similar manners, etc.
  • Legitimate interest basis: Where the customer or any other persons having similar characteristics are juristic persons, the Processing of Personal Data of persons related to the customers or any other persons having similar characteristics is necessary for the legitimate interests of the Company in its business operations, such as communicating with customers, etc.
(e) For the purpose of changing information relating to customers in the Company’s system
  • Legitimate interest basis: The Processing of Personal Data of customers or persons related to the customers or any other persons having similar characteristics is necessary for the legitimate interests of the Company in facilitating customers, persons related to the customers, or any other persons having similar characteristics to edit their information in the Company’s system in order to make it accurate, up-to-date, complete, and not to cause any misunderstanding.
(f) For the purpose of receiving complaints from customers, persons related to the customers, or any other persons having similar characteristics
  • Legitimate interest basis: The Processing of Personal Data of customers or any other persons having similar characteristics is necessary for the legitimate interests of the Company in facilitating customers, persons related to the customers, or any other persons having similar characteristics in complaining or providing comments in order to improve the quality of services provided by the Company.
(g) For the purpose of public relations and marketing activities of the Company
  • Consent basis: Where the Company proceeds with any marketing activities, such as sending marketing messages to customers, taking photographs or recording videos of customers in order to process and publicize marketing activities through various channels, the Company will undertake the activities by relying on the consent received from you.
(h) For the purpose of analyzing your use of websites, applications, or other media in order to improve the quality of services of the Company or for marketing purposes
  • Legitimate interest basis: The Processing of your Personal Data from the use of website, application, or other media is necessary for the legitimate interests of the Company in its business operations and improvement of quality of services, such as improvement of website, application, or other means, improvement of product and service quality, as well as improvement of defects and problems in relation to the products and services.
  • Consent basis: In case where the Company collects and Processes your Personal Data in order to analyze and advertise products/services based on your behavior, or conduct direct marketing campaigns, or in the case where the Laws on Personal Data Protection require your consent, the Company will undertake such actions by relying on the consent received from you.
(i) For the purpose of communicating with customers or any other persons having similar characteristics
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests in communicating with you regarding the provision of services of the Company, such as performing according to the service request, answering your questions or comments, etc.
(j) For the purpose of complying with the laws relating to the Company’s business and legitimate orders of government agencies and relevant officers
  • Legal basis: To act in compliance with the applicable laws of the Company, such as taxation law, Laws on Personal Data Protection, and legitimate orders of government agencies and relevant officers, such as Office of the Personal Data Protection Commission (PDPC Office), etc.
(k) For the purpose of establishment, compliance, exercise or defense of legal claims of the Company
  • Legitimate interest basis: The Processing of Personal Data is necessary for the establishment, compliance, exercise or defense of legal claims in various stages according to the law, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court, etc.
(l) For the purpose of monitoring, protecting and ensuring the security of persons and properties of the Company
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in monitoring, protecting and ensuring the security of properties of the Company. For example, the CCTV footages can be used to prevent loss or damage to the Company’s properties or to track properties or claim damages in case where the properties of the Company are lost or damaged, etc.
  • Preventing or suppressing danger to a person’s life, body, or health basis: The Processing of Personal Data is necessary for the benefit in monitoring, preventing, or suppressing any circumstances which may be dangerous to person’s life, body, or health.
(m) For any transaction that is necessary and beneficial to you or those which are directly related to the purposes set forth above
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in carrying out any transactions which are necessary for the Company and/or beneficial to you or directly related to the purposes set forth above. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
(n) For other purposes that the Company will notify you of
  • The Company will notify you of any other purposes that cause the Company to Process your Personal Data other than the purposes set forth above or when the Company changes the original purposes that were set forth. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
5.2 Your Personal Data, which the Company will Process for the Purposes set forth in Clause 5.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or the provision of any relevant services to you, whether in whole or in part.
5.3 In the event that the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case maybe).
6. Disclosure of Personal Data
6.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following entities and persons:
  • (a) Charoen Pokphand Group, in and outside Thailand, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.
  • (b) Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services, such as information technological services, data recording services, payment services, mailing services, delivery services, printing services, data analysis services, research services, marketing services, or any other services which may be beneficial to you or relevant to the Company’s business operation.
  • (c) Advisors of the Company, such as legal advisors, lawyers, auditors, or any other internal and external experts of the Company.
  • (d) Relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission pursuant to applicable laws, such as Revenue Department, Office of the Personal Data Protection Commission, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, and court, etc.
  • (e) Any persons or other entities that you have given consent to disclose your Personal Data to, such as the disclosure of processed images of activities through various media platforms of the Company to the general public.
6.2 The disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by law, provided that if the law requires your consent to be provided, the Company will request for your prior consent.
6.3 In the event that the Company discloses your Personal Data to third parties, the Company will put in place appropriate safeguards to protect the Personal Data that has been disclosed and to comply with the standards and duties relating to the protection of Personal Data as prescribed by the Laws on Personal Data Protection. Where the Company sends or transfers your Personal Data outside Thailand, the Company will ensure that the recipient country, the international organization or such overseas recipient has a sufficient standard for the protection of Personal Data. In some cases, the Company may request your consent for the transfer of your Personal Data outside Thailand, subject to the requirements under Laws on Personal Data Protection.
7. Retention Period
The Company will retain your Personal Data for the period necessary to fulfil the Purposes for which the Personal Data was Processed, whereby the retention period will vary depending on the Purposes for which such Personal Data was collected and Processed. The Company will retain Personal Data for the period prescribed under the applicable laws (if any) by considering the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the documents or Personal Data collected by the Company and having regard to the Company’s business practices and relevant business in relation to each category of Personal Data.
In this regard, the Company will retain your Personal Data for the period not exceeding 10 years, starting from the date your legal relations/transactions with the Company come to an end. However, the Company may retain your Personal Data for a longer period of such time prescribed if the laws permit or such retention of Personal Data is necessary for the establishment of the right of claim of the Company.
After the period of time set forth above has expired, the Company will delete or destroy such Personal Data from the storage or system of the Company and other persons providing services to the Company (if any) or anonymize your Personal Data, unless in the event that the Company can continue to retain such Personal Data as prescribed by the Laws on Personal Data Protection or other applicable laws. In this regard, for additional details regarding the retention period of your Personal Data, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.
8. Your Rights in relation to Personal Data
As the data subject, you have the following rights in relation to your Personal Data, subject to the rules, methods and conditions under the Laws on Personal Data Protection. In this regard, if you wish to make a request to exercise your rights, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8.1 Right of Access You have the right to access your Personal Data and may request that the Company provide you with a copy of such Personal Data in accordance with the requirements under the Laws on Personal Data Protection.

8.2 Right to Data Portability You have the right to obtain your Personal Data, including to request that your Personal Data is transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements under the Laws on Personal Data Protection.

8.3 Right to Object You have the right to raise an objection to the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.4 Right to Erasure You may request that the Company delete, destroy or anonymize your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.5 Right to Restriction You have the right to request that the Company restrict the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.6 Right to Rectification You have the right to request that your Personal Data be rectified if the Personal Data is inaccurate, not up-to-date, incomplete, or may cause a misunderstanding.

8.7 Right to Withdraw Consent If the Company relies on your consent as the lawful basis for Processing your Personal Data, you have the right to withdraw such consent which has been provided to the Company at any time.

8.8 Right to Lodge a Complaint If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 9 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Committee in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 9 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Committee in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

9. How to Contact the Company
The Company has designated Charoen Pokphand Group Company Limited as the coordinator for matters relating to the Company’s Personal Data protection. If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact information provided below:
Data Protection Officer
E-mail:
cpgroup_compliance@cp.co.th
Address:
Corporate Compliance Office, Charoen Pokphand Group Company Limited
1 Fortune Tower, 17th Floor, Ratchadaphisek Road, Din Daeng, Din Daeng, Bangkok 10400
10. Changes to This Privacy Policy
The Company may make changes to this Privacy Policy from time to time to reflect any changes to our Processing of your Personal Data and to comply with any changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Policy and the amended Privacy Policy through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Policy from time to time.
Document No. CPG-002-FM-CCO-PDPA-TH-01-20220531
This Privacy Policy shall be effective from 1 June 2022
PERSONAL DATA PRIVACY NOTICE FOR PROCESSES RELATED TO VENDORS OF CHAROEN POKPHAND GROUP COMPANY LIMITED
1. General Provisions
For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendments which may be made thereto, (“Laws on Personal Data Protection”) Charoen Pokphand Group Company Limited (“Company”) has prepared this personal data privacy notice for processes related to vendors of Charoen Pokphand Group Company Limited (“Privacy Notice”) to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”), for instance, the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, alignment, combination, prohibition of access or restriction, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:
2. Groups or Categories of Persons from whom the Company Collects Personal Data
Under this Privacy Notice, groups or categories of persons from whom the Company collects and Processes Personal Data are as follows:

2.1 Prospective vendors which means persons who may become vendors of the Company, both in the case where such persons have declared intention to enter into a contract and/or will register as vendors of the Company and in the case where the Company collects Personal Data on its own initiative, such as service providers, consultants, experts, academics, lecturers, those who are interested to participate in a business project, contracting parties or any other persons having similar characteristics, etc.;

2.2 Vendors which means persons who provide quotations for products and/or services to be sold to the Company or have registered as vendors with the Company or have any other relationships of a similar nature with the Company, such as service providers, consultants, experts, academics, participants in a business project, contracting parties or any other persons having similar characteristics, etc.; and

2.3 Persons in relation to prospective vendors or vendors which means natural persons who are related to or act as representatives of the prospective vendors or vendors, such as directors, employees, representatives, or personnel of prospective vendors or vendors who are juristic persons, including those whose Personal Data appears in various documents in connection to relevant processes, such as managers, purchasers, consignees, and cheque payers, etc.

3. How the Company Collects and Receives your Personal Data
3.1 The Company collects and receives your Personal Data via the following methods:
  • (a) Personal Data which you directly provide to the Company
    You may directly provide your Personal Data to the Company, such as when you complete and submit forms online through website or other means, when you enter into a contract with the Company, when you deliver to the Company documents or copies of documents which contain Personal Data, when you make enquiries, provide comments or feedbacks, or send complaints to the Company via telephone, e-mail, fax, mail, or application, etc.
  • (b) Personal Data which the Company automatically collects from you
    The Company may collect your Personal Data by automated means, such as the use of Cookies or other similar technologies. For more details, please see the Company’s Cookie Policy
  • (c) Personal Data which the Company receives from third parties
    The Company may receive your Personal Data from third parties, such as collect your Personal Data from public data sources, sources containing information relating to your business, or sources containing information relating to trades, etc.
3.2 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to, the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request your explicit consent.
3.3 Where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. In this regard, you have the right to withdraw your consent by contacting the Company using the contact details set out in Clause 9 of this Privacy Notice. However, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.
4. Collected Personal Data
Your Personal Data that is collected and Processed under this Privacy Notice, regardless of whether such Personal Data was directly provided by you to the Company or automatically collected from you by the Company, or was provided to the Company by third parties, includes the following:

4.1 Personal information, such as first name, last name, marital status, date/month/year of birth, age, sex, national identification number, passport number, place of birth, height, date/month/year of expired, photograph, signature, parents name and surname, educational background and employment history etc.

4.2 Contact information, such as address on national identification, address on house registration, telephone number, fax number, e-mail, Line ID, and details of person who may be contacted, etc.

4.3 Information concerning sale and purchase transaction, such as vendor code, details of delivery, account number, and amount of money, etc.

4.4 Information that is used as supporting evidence in the Company’s vendor registration or execution of transactions, such as Personal Data which appears in a copy of national identification card, Tax ID, copy of passport, copy of change of name certificate, copy of house registration book, copy of driving license, car number plate, type of car, copy of title deed, copy of power of attorney, copy of company affidavit, invoice, receipt, cash bill or certification of payment, cheque and cheque stub, payment voucher, copy of bank account, copy of card of company’s authorize person, transfer receipt, copy of PhorPor. 09/20, copy of professional or business license and contract etc.

4.5 Technical information, such as log file, IP Address, and information that the Company collects through the use of Cookies or other similar technologies, etc.

4.6 Other information, such as voice recording of conversations, and photo and video recording by means of CCTV, etc.

5. Purposes and Lawful Basis for the Collection, Use, Disclosure and Processing of Personal Data
5.1 The Company Processes your Personal Data for the purposes under lawful basis as follows (collectively, the “Purposes”):
No. Purposes Lawful basis of the Processing
(a) For the purpose of collection of the list of names of prospective vendors or any other persons having similar characteristics for the procurement of the Company
  • Contractual basis: Where the prospective vendors wish to enter into a sales or service agreement with the Company by being the parties submitting request or providing Personal Data to the Company.
  • Consent basis: Where prospective vendors do not submit request to the Company wishing to enter into a sales or service agreement with the Company but the Company collects Personal Data of prospective vendors by the Company’s own initiative.
(b) For the purpose of registration of prospective vendors or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data is necessary for carrying out the request of prospective vendors or any other persons having similar characteristics in order to register as vendors or any other performances in similar means.
(c) For the purpose of report preparation and analysis of information which are necessary for the business operation of the Company
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in its business operation, such as product/service purchase report for historical record, etc.
(d) For the purpose of procurement and selection of vendors or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data is necessary for carrying out requests for quotation by vendors, or any other persons having similar characteristics, before entering into a sales agreement, service agreement, or any other agreement relating to procurement by the Company.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in its business operations and for compliance with the Company’s procurement policy, such as the verification of information and qualifications of vendors, etc.
(e) For the purpose of registration of new vendors or any other persons having similar characteristics, including carrying out requests of vendors or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data is necessary for the registration new vendors or any other persons having similar characteristics, including carrying out requests of vendors or any other persons having similar characteristics in the Company’s system, such as the changes of vendor’s information, etc.
(f) For the purpose of execution and management of agreements between the Company and any other contractual parties
  • Contractual basis: The Processing of Personal Data of the contractual party is necessary for carrying out the request of such party who has expressed the intention to enter into an agreement with the Company.
  • Legitimate interest basis: The Processing of Personal Data of the contractual party (or any person related to the contractual party, in the event where the contractual party is a juristic person) is necessary for the legitimate interests of the Company in the execution and management of the Company’s agreements, such as the verification of identity and qualifications of contractual party, etc.
(g) For the purpose of performing obligations under agreements made with vendors or any other persons having similar characteristics
  • Contractual basis: The Processing of Personal Data is necessary for performing obligations under agreements made with vendors or any other persons having similar characteristics, such as ordering of products or services, setting debt and paying for products or services, and receiving products or services, etc.
(h) For the purpose of communicating with vendors or any other persons having similar characteristics
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in the business communication with vendors or any other persons having similar characteristics, such as contacting with vendors or vendor’s representatives in order to receive products or services, etc.
(i) For the purpose of complying with relevant laws which are applicable to the Company’s business and legitimate orders of government agencies and relevant officials
  • Legal basis: To act in compliance with laws which are applicable to the Company, such as taxation laws, Laws on Personal Data Protection, and legitimate orders of government agencies and relevant officers, such as Office of the Personal Data Protection Commission (PDPC Office), etc.
(j) For the purpose of establishment, compliance, exercise or defense of legal claims, in various stages according to the laws
  • Legitimate interest basis: The Processing of Personal Data is necessary for the establishment, compliance, exercise or defense of legal claims in various stages according to the law, such as, investigation and/or inquiry by government officials, case preparation, prosecution, and/or pursuit of the case in court, etc.
(k) For the purpose of monitoring, protecting and ensuring the security of persons and properties of the Company
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in monitoring, protecting and ensuring the security of properties of the Company. For example, the CCTV footages can be used to prevent loss or damages to the Company’s properties or to track properties or claim damages in case where the properties of the Company are lost or damaged, etc.
  • Preventing or suppressing danger to a person’s life, body, or health basis: The Processing of Personal Data is necessary for the benefit in monitoring, preventing, or suppressing any circumstances which may be dangerous to a person’s life, body, or health.
(l) For any transaction that is necessary and beneficial to you or those which are directly related to the purposes set forth above.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in carrying out any transactions which are necessary for the Company and/or beneficial to you or directly related to the purposes set forth above. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
(m) For other purposes that the Company will notify you of
  • The Company will notify you of any other purposes that cause the Company to Process your Personal Data other than the purposes set forth above or when the Company changes the original purposes that were set forth. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
5.2 Your Personal Data, which the Company will Process for the Purposes set forth in Clause 5.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or the provision of any relevant services to you, whether in whole or in part.
5.3 In the event that the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send a notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case maybe).
6. Disclosure of Personal Data
6.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following entities and persons:
  • (a) Charoen Pokphand Group, in and outside Thailand, both in and outside Thailand, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.
  • (b) Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services, such as employee health check service by business partner, information technological services, data recording services, payment services, mailing services, delivery services, printing services, health care service, insurance service, training service, data analysis services, research services, marketing services, or any other services which may be beneficial to you or relevant to the Company’s business operations such as commercial bank, hospital, insurance company, office of insurance commission, etc.
  • (c) Advisors of the Company, such as legal advisors, lawyers, auditors, or any other internal and external experts of the Company, etc.
  • (d) Relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission pursuant to applicable laws, such as Revenue Department, Ministry of Commerce, Office of the Personal Data Protection Commission, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, and court, etc.
  • (e) Any persons or any other entities that you have given consent to disclose your Personal Data to.
6.2 The disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by law, provided that if the law requires your consent to be provided, the Company will request your prior consent.
6.3 In the event that the Company discloses your Personal Data to third parties, the Company will put in place appropriate safeguards to protect the Personal Data that has been disclosed and to comply with the standards and duties relating to the protection of Personal Data as prescribed by the Laws on Personal Data Protection. Where the Company sends or transfers your Personal Data outside Thailand, the Company will ensure that the recipient country, the international organization or such overseas recipient has a sufficient standard for the protection of Personal Data. In some cases, the Company may request your consent for the transfer of your Personal Data outside Thailand, subject to the requirements under Laws on Personal Data Protection.
7. Retention Period
The Company will retain your Personal Data for the period necessary to fulfil the Purposes for which the Personal Data was Processed, whereby the retention period will vary depending on the Purposes for which such Personal Data was collected and Processed. The Company will retain Personal Data for the period prescribed under the applicable laws (if any) by considering the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the documents or Personal Data collected by the Company and having regard to the Company’s business practices and relevant business in relation to each category of Personal Data.
In this regard, the Company will retain your Personal Data for a period not exceeding 10 years, starting from the date your legal relations/transactions with the Company come to an end. However, the Company may retain your Personal Data for a longer period of such time prescribed if the laws permit or such retention of Personal Data is necessary for the establishment of the right of claim of the Company.
After the period of time set forth above has expired, the Company will delete or destroy such Personal Data from the storage or system of the Company and other persons providing services to the Company (if any) or anonymize your Personal Data, unless in the event that the Company can continue to retain such Personal Data as prescribed by the Laws on Personal Data Protection or other applicable laws. In this regard, for additional details regarding the retention period of your Personal Data, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.
8. Your Rights in relation to Personal Data
As the data subject, you have the following rights in relation to your Personal Data, subject to the rules, methods and conditions under the Laws on Personal Data Protection. In this regard, if you wish to make a request to exercise your rights, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8.1 Right of Access You have the right to access your Personal Data and may request that the Company provide you with a copy of such Personal Data in accordance with the requirements under the Laws on Personal Data Protection.

8.2 Right to Data Portability You have the right to obtain your Personal Data, including to request that your Personal Data is transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements under the Laws on Personal Data Protection.

8.3 Right to Object You have the right to raise an objection to the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.4 Right to Erasure You may request that the Company delete, destroy or anonymize your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.5 Right to Restriction You have the right to request that the Company restrict the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.6 Right to Rectification You have the right to request that your Personal Data be rectified if the Personal Data is inaccurate, not up-to-date, incomplete, or may cause a misunderstanding.

8.7 Right to Withdraw Consent If the Company relies on your consent as the lawful basis for Processing your Personal Data, you have the right to withdraw such consent which has been provided to the Company at any time.

8.8 Right to Lodge a Complaint If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 9 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Committee in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

However, the Company reserve the right to consider your request to exercise your rights and act in accordance with the requirements under the Laws on Personal Data Protection.

9. How to Contact the Company
The Company has designated Charoen Pokphand Group Company Limited as the coordinator for matters relating to the Company’s Personal Data protection. If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact information provided below:
Data Protection Officer
E-mail:
cpgroup_compliance@cp.co.th
Address:
Corporate Compliance Office, Charoen Pokphand Group Company Limited
1 Fortune Tower, 17th Floor, Ratchadaphisek Road, Din Daeng, Din Daeng, Bangkok 10400
10. Changes to This Privacy Policy
The Company may make changes to this Privacy Policy from time to time to reflect any changes to our Processing of your Personal Data and to comply with any changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Policy and the amended Privacy Policy through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Policy from time to time.
Document No. CPG-003-FM-CCO-PDPA-TH-01-20220531
This Privacy Policy shall be effective from 1 June 2022
PERSONAL DATA PRIVACY NOTICE FOR PROCESSES RELATED TO PERSONNEL OF CHAROEN POKPHAND GROUP COMPANY LIMITED
1. General Provisions
For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendments which may be made thereto, (“Laws on Personal Data Protection”) Charoen Pokphand Group Company Limited (“Company”) has prepared this personal data privacy notice for processes related to personnel of Charoen Pokphand Group Company Limited (“Privacy Notice”) to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”), for instance, the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, alignment, combination, prohibition of access or restriction, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:
2. Groups or Categories of Persons whom the Company Collects Personal Data
Under this Privacy Notice, groups or categories of persons from whom the Company collects and Processes Personal Data are as follows:

2.1 Job applicants which means persons who may be selected to be personnel of the Company, whereby the Company may directly collect Personal Data from the job applicants or obtain his/her Personal Data from third parties;

2.2 Personnel which means persons who work or perform any duties for the Company and receive wages, welfare benefits, or any other compensations from the Company, irrespective of what such compensation is called, such as directors, executives, managers, employees, personnel. trainees, or any other persons having similar characteristics, but not including contractors or service providers which are business partners of the Company; and

2.3 Persons related to the job applicants and personnel which means persons related to the job applicants and personnel of the Company, and including persons whose Personal Data appear in the relevant documents and processes, such as family members (e.g., father, mother, spouse, and child, etc.), persons who may be contacted in case of emergency, reference person, beneficiaries, and guarantors, etc.

3. How the Company Collects and Receives your Personal Data
3.1 The Company collects and receives your Personal Data via the following methods:
  • (a) Personal Data which you directly provide to the Company
    You may directly provide your Personal Data to the Company, such as when you submit job application forms and additional documents for job application to the Company whether by walk-in, apply at job application booth, such as apply through the Company’s website and including in the event that you attend a job interview, enter into a contract with the Company, and submit documents containing your Personal Data to the Company, etc.
  • (b) Personal Data which the Company automatically collects from you
    The Company may collect your Personal Data by automated means, such as the use of Cookies or other similar technologies. For more details, please see the Company’s Cookie Policy
  • (c) Personal Data which the Company receives from third parties
    The Company may receive your Personal Data from third parties, such as job application website of third party, your reference person, recruitment company, government agency, educational institution, social media source, or job application form and/or documents of persons related to you as you are a family member, persons who may be contacted in case of emergency, reference person, beneficiary, or guarantor of such person, etc.
3.2 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to, the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request your explicit consent.
3.3 Where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. In this regard, you have the right to withdraw your consent by contacting the Company using the contact details set out in Clause 9 of this Privacy Notice. However, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.
4. Collected Personal Data
Your Personal Data that is collected and Processed under this Privacy Notice, regardless of whether such Personal Data was directly provided by you to the Company or automatically collected from you by the Company, or was provided to the Company by third parties, includes the following:

4.1 Personal information, such as first name, last name, date/month/year of birth, age, sex, weight, height, identification number, photograph, signature, nationality, race, religion, marital status, military status, family member details (such as father, mother, spouse, and children, etc.), health condition, and biometric data (such as fingerprint, palm print, iris recognition and face simulation, etc.), etc.

4.2 Contact information, such as address, telephone number, fax number, e-mail, Line ID, and emergency contact person details, and reference person details etc.

4.3 Information on education and training, such as academic and training background (such as institution name, faculty, program, and year of graduation, etc.), academic certificate, transcript, language skills, computer skills, training and test details, and activities participated during the time of study, etc.

4.4 Information on job application, such as personal profile, working experience, details in resume/CV, criminal record, position applied, expected salary, interviewed details, evidence or reference documents, and details as appeared in the interview assessment form (such as assessment results, knowledge and experience, personal characteristics, team work, and working potentials), etc.

4.5 Information that is used as supporting evidence in the job application or in execution of juristic acts, such as Personal Data which appears in a copy of the national identification card, copy of passport, copy of change of name certificate, copy of house registration book, copy of military service certificate, copy of bank account book, copy of marriage certificate, copy of birth certificate, form for approval of salary of new staff and monthly staff, medical certificate, result of pre-employment medical check, form for specifying beneficiary, social security application form, letter of consent for personal background check, result of personal background check, employment contract, letter of guarantee for performance of employment contract, and relevant documents (such as certificate of employment specifying job position, copy of civil servant card, certificate of employment specifying salary, copy of business registration or document on the incorporation of the Company containing the name of guarantor for performance of employment contract as the owner or partner, etc.), directorship agreement, and power of attorney, etc.

4.6 Information on work and assessment, such as personnel code, position, department, affiliation, chain of command, performance assessment, working behavior, achievement and/or award received, training information, disciplinary action information, details which appear in personnel transfer document of the Company, personnel on loan contract, letter of resignation, and reason for the resignation, etc.

4.7 Information on benefit and remuneration, such as salary, wages, reward, bonus, pension details, welfare, bank account number, guarantor’s details, beneficiary’s details, social security details, provident fund details, tax details, tax deduction details, health benefit details (including for family member) and/or other benefits, Personal Data which appears in medical certificates, annual health reports, maternity leave forms, welfare money lending forms, salary reduction consent letters, receipts, invoices, compensation request forms (for accident and life insurance) and retirement benefit request form, etc.

4.8 Information on registration statistics, such as starting date, probation end date, working date and time, hours of work, hours of overtime work, annual leave, leave date, leave form, leave details including reasons for such leave, the Company entry and exit record, and usage record of systems of the Company, etc.

4.9 Technical information, such as log file, IP Address, and information that the Company collects through the use of Cookies or other similar technologies, etc.

4.10 Other information, such as voice recording of conversations, and photo and video recording by means of CCTV, any information that you sent to us for the website connecting such as comment and your location etc.

5. Purposes and Lawful Basis for the Collection, Use, Disclosure and Processing of Personal Data
5.1 The Company Processes your Personal Data for the purposes under lawful basis as follows (collectively, the “Purposes”):
No. Purposes Lawful basis of the Processing
(a) For the purpose of recruitment, job applicant selection, interview, and any transactions in relation to the recruitment process
  • Contractual basis: The Processing of Personal Data of the job applicants is necessary for the consideration of their request to apply for a job and enter into the Company’s recruitment process.
  • Legitimate interest basis: The Processing of Personal Data of the job applicants or persons related to the job applicants is necessary for the legitimate interests of the Company in its recruitment process or performance after recruitment, such as job applicant selection, and consideration of the qualification of job applicants, etc.
  • Consent basis: The Company collects Personal Data of prospective employees by the Company’s own initiative, from third parties, such as recruiters via website(s), whereby the prospect employees have not expressed their intention to apply for a job with the Company.
  • Consent basis: The Processing of your Personal Data as family members or reference persons of the job applicants will be relying on the consent received from you.
(b) For the purpose of salary and benefit approval for the Company’s employees
  • Contractual basis: The Processing of Personal Data of the job applicants is necessary for the consideration of the job applicant’s request who has passed the interview process and has entered into salary and benefit approval of the employee before entering into an employment contract or other contracts in order to be placed as an employee of the Company.
  • Legitimate interest basis: The Processing of Personal Data of the job applicants is necessary for the legitimate interests of the Company as the Processed Personal Data is necessary for the consideration of salary and benefit approval of the employees of the Company.
(c) For the purpose of any other processes in relation to employment and placement of an employee into work, such as conducting medical check-ups before commencement of the job, beneficiary specification, social security registration, criminal record check, entering into an employment contract, and entering into a work guarantee contract, etc.
  • Contractual basis: The Processing of Personal Data of personnel is necessary for the entry into an employment contract and other relevant contracts, including undertaking any processes necessary before entering into such contract. As for the guarantor for performance of employment contract, the Processing of Personal Data of the guarantor for performance of employment contract is necessary for the entry into a guarantee contract which the guarantor for performance of employment contract is a party.
  • Legitimate interest basis: The Processing of the Personal Data of personnel and persons related to the personnel is necessary for the Company in its human resources management, such as verifying and considering the personnel’s qualification in order to identify the appropriate position for the personnel, etc.
  • Legal basis: For the directors and executives of the Company, the disclosure of Personal Data of directors and executives of the Company is necessary for the performance according to the Securities and Exchange Act B.E. 2535 (1992), such as preparation of forms and documents to be submitted to relevant entities.
  • Consent basis: The Processing of sensitive Personal Data, such as criminal records, health information and biometric information will be based on the consent received from the personnel.
(d) For the purpose of management of welfare and benefit of personnel, including but not limited to welfare money loan, medical expense reimbursement, discounts for personnel, annual physical examination, insurance, and claims related to insurance
  • Contractual basis: The Processing of Personal Data of personnel is necessary for the Company to perform its obligations according to the employment contracts and any other contracts to which the personnel is a contracting party.
  • Legitimate interest basis: The Processing of Personal Data of personnel and persons related to the personnel is necessary for the Company in its human resources management, such as allocation of welfare and benefit for the personnel and persons related to the personnel.
  • Compliance with the laws for labour protection and social security purpose basis: The Processing of Personal Data of employees is necessary for the compliance of laws to fulfil the purpose of labour protection and social security, benefits relating to medical treatment of legal right holder, road accident victim protection, or social protection.
  • Consent basis: The Processing of sensitive Personal Data of personnel and persons related to the personnel, such as health information, for the management of group insurance and other benefits, will be undertaken by relying on the consent received from the personnel and persons related to the employees.
(e) For the purpose of the performance of duty of personnel according to the employment contract, employment agreement, appointment contract, or any other contracts entered into with the Company
  • Contractual basis: The Processing of Personal Data of relevant personnel is necessary for the performance of duty or work according to the scope of work specified in the employment contract, employment agreement, appointment contract, or any other contracts to which the personnel have entered into with the Company, such as the use and disclosure of name, surname and Personal Data which appears in the employee’s national identification card to verify identity as an authorized person in contract signing or exercising any juristic acts on behalf of the Company, including the use and disclosure of the personnel’s name in the notification, approval letter, form, or other documents of the Company according to the scope and duty or work which such employees are responsible, etc.
  • Legitimate interest basis: The Processing of Personal Data of employee is necessary for the legitimate interests of the Company in its business operation and compliance with the applicable laws of the Company.
(f) For the purpose of record of working time, payment of salary, bonus, remuneration or any other benefits
  • Contractual basis: The Processing of Personal Data of employees is necessary for the payment of wages, salary, bonus, remuneration and/or any other benefits according to the employment contracts and any other contracts to which the personnel is a contracting party.
  • Legal basis: In some cases, the Processing of Personal Data of personnel and persons related to the personnel is the performance in compliance with the applicable laws of the Company, such as withholding tax pursuant to the taxation laws, etc.
  • Consent basis: The Processing of sensitive Personal Data, such as biometric information will be based on the consent received from the employees.
(g) For the purpose of the compliance with the laws relating to human resource management and legitimate orders of government agencies and relevant officers
  • Legal basis: The Processing of Personal Data of employees and persons in relation to the employees is the performance in compliance with the applicable laws of the Company, including but not limited to labour law, social security law, taxation law, securities and exchanges law, Personal Data protection law, such as submission of annual registration statement (Form 56-1) to the Securities and Exchange Commission, submission of Personal Data of employee to relevant government agencies, such as Revenue Department, Social Security Office, and Department of Empowerment of Persons with Disabilities, and Department of Skill Development etc.
(h) For the purpose of assessment of work or duty of the employees
  • Legitimate interest basis: The Processing of Personal Data of employees is necessary for the legitimate interests in the assessment of work of the employees, human resources management, or any other benefits in the business operation of the Company.
(i) For the purpose of the management of training personnel, including but not limited to the collection of the names of persons who wish to attend the training, and the operation and management of registration and other facilities
  • Legitimate interest basis: The Processing of Personal Data of personnel is necessary for the legitimate interests of the Company in its training management, such as training registration, preparation of action plan and training form, including allocation of appropriate facilities for the training, etc.
(j) For the purpose of personnel transfer and secondment
  • Legitimate interest basis: The Processing of your Personal Data of employee is necessary for the legitimate interests in the human resource management of the Company, such as personnel transfer or secondment, etc.
  • Contractual basis: The Processing of Personal Data of employee is necessary for the performance of the employment contract, personnel transfer contract which the employee is a contracting party, or any other contracts in similar manners.
  • Where the Company sends or transfers Personal Data of employees to other countries, the Company will ensure that the recipient country has sufficient standard for the protection of Personal Data. In some cases, the Company may require consent from the employees for the sending or transferring of Personal Data of employees to other countries, subject to the requirements under the Laws on Personal Data Protection.
(k) For the purpose of human resources management in other aspects, such as disciplinary punishment, termination of employment, resignation, and retirement, etc.
  • Contractual basis: The Processing of Personal Data of personnel is necessary for the performance according to the employment contract and other contracts which the employees are contracting parties, such as termination of employment, where the employee resigns or retires, and disciplinary punishment record for the employee who violates working rules or regulations, etc.
  • Legal basis: The Processing of Personal Data of employees is necessary for the performance in compliance with the applicable laws of the Company, such as the performance pursuant to the termination process, resignation or retirement of employees in accordance with the labour protection law and the law on provident funds, etc.
  • Compliance with the laws for labour protection purpose basis: The Processing of Personal Data of employees is necessary for the compliance of applicable laws of the Company to fulfil the purpose of labour protection, such as disciplinary punishment and employment termination, etc.
  • Legitimate interest basis: The Processing of Personal Data of employee is necessary for the legitimate interests of human resources management of the Company, such as disciplinary punishment and disciplinary punishment records of the employees and the termination of being employees of the Company, etc.
(l) For the purpose of communications with the job applicants, personnel and persons related to the personnel
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in communicating with the job applicants, personnel, and persons related to the personnel.
(m) For the purpose of establishment, compliance, exercise or defense of legal claims of the Company
  • Legitimate interest basis: The Processing of Personal Data is necessary for the establishment, compliance, exercise or defense of legal claims in various stages according to the laws, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court, etc.
(n) For the purpose of monitoring, protecting and ensuring the security of persons and properties of the Company.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in monitoring, protecting and ensuring the security of properties of the Company. For example, the CCTV footages can be used to prevent loss or damage to the Company’s properties or to track properties or claim damages in the case where the properties of the Company are lost or damaged, etc.
  • Preventing or suppressing a danger of person’s life, body, or health basis: The Processing of Personal Data is necessary for the benefit in monitoring, preventing, or suppressing any circumstances which may be dangerous to person’s life, body, or health.
(o) For any transaction that is necessary and beneficial to you or those which are directly related to the purposes set forth above.
  • Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in carrying out any transactions which are necessary for the Company and/or beneficial to you or directly related to the purposes set forth above. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request for your explicit consent.
(p) For other purposes that the Company will notify you of
  • The Company will notify you of any other purposes that cause the Company to Process your Personal Data other than the purposes set forth above or when the Company changes the original purposes that were set forth. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
5.2 Your Personal Data which the Company will Process for the Purposes set forth in Clause 5.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or the provision of any relevant services to you, whether in whole or in part.
5.3 In the event that the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case maybe).
6. Disclosure of Personal Data
6.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following entities and persons:
  • (a) Charoen Pokphand Group, in and outside Thailand, both in and outside Thailand, including executives, directors, staffs, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.
  • (b) Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services, such as employee’s medical check by business partners, information technological services, data recording services, payment services, mailing services, delivery services, printing services, health services, insurance services, training services, data analysis services, research services or any other services which may be beneficial to you or relevant to the Company’s business operation, such as commercial bank, hospital, life insurance company, and non-life insurance company, etc.
  • (c) Advisors of the Company, such as legal advisors, lawyers, auditors, or any other internal and external experts of the Company.
  • (d) Relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission in pursuant to applicable laws, such as Department of Labour Protection and Welfare, Department of Skill Development, Department of Empowerment of Persons with Disabilities, Social Security Office, Department of Provincial Administration, Department of Business Development, Department of Intellectual Property, Office of the Personal Data Protection Commission, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, court, and Legal Execution Department, etc.
  • (e) Customers, vendors, contracting parties of the Company which you have contacted or are relevant to your duty or position, or any other persons in similar manners.
  • (f) Any persons or any other entities that you have given consent to disclose your Personal Data to.
6.2 The disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by law, provided that if the law requires your consent to be provided, the Company will request for your prior consent.
6.3 In the event that the Company discloses your Personal Data to third parties, the Company will put in place appropriate safeguards to protect the Personal Data that has been disclosed and to comply with the standards and duties relating to the protection of Personal Data as prescribed by the Laws on Personal Data Protection. Where the Company sends or transfers your Personal Data outside Thailand, the Company will ensure that the recipient country, the international organization or such overseas recipient has a sufficient standard for the protection of Personal Data. In some cases, the Company may request your consent for the transfer of your Personal Data outside Thailand, subject to the requirements under Laws on Personal Data Protection.
7. Retention Period
The Company will retain your Personal Data for the period necessary to fulfil the Purposes for which the Personal Data was Processed, whereby the retention period will vary depending on the Purposes for which such Personal Data was collected and Processed. The Company will retain Personal Data for the period prescribed under the applicable laws (if any) by considering the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the documents or Personal Data collected by the Company and having regard to the Company’s business practices and relevant business in relation to each category of Personal Data.
In this regard, the Company will retain your Personal Data for the period not exceeding 10 years, starting from the date your legal relations/transactions with the Company come to an end. However, the Company may retain your Personal Data for a longer period of such time prescribed if the laws permit or such retention of Personal Data is necessary for the establishment of the right of claim of the Company.
After the period of time set forth above has expired, the Company will delete or destroy such Personal Data from the storage or system of the Company and other persons providing services to the Company (if any) or anonymize your Personal Data, unless in the event that the Company can continue to retain such Personal Data as prescribed by the Laws on Personal Data Protection or other applicable laws. In this regard, for additional details regarding the retention period of your Personal Data, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.
8. Your Rights in relation to Personal Data
As the data subject, you have the following rights in relation to your Personal Data, subject to the rules, methods and conditions under the Laws on Personal Data Protection. In this regard, if you wish to make a request to exercise your rights, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8.1 Right of Access You have the right to access your Personal Data and may request that the Company provide you with a copy of such Personal Data in accordance with the requirements under the Laws on Personal Data Protection.

8.2 Right to Data Portability You have the right to obtain your Personal Data, including to request that your Personal Data is transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements under the Laws on Personal Data Protection.

8.3 Right to Object You have the right to raise an objection to the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.4 Right to Erasure You may request that the Company delete, destroy or anonymize your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.5 Right to Restriction You have the right to request that the Company restrict the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.6 Right to Rectification You have the right to request that your Personal Data be rectified if the Personal Data is inaccurate, not up-to-date, incomplete, or may cause a misunderstanding.

8.7 Right to Withdraw Consent If the Company relies on your consent as the lawful basis for Processing your Personal Data, you have the right to withdraw such consent which has been provided to the Company at any time.

8.8 Right to Lodge a Complaint If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 9 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Committee in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

However, the Company reserve the right to consider your request to exercise your rights and act in accordance with the requirements under the Laws on Personal Data Protection.

9. How to Contact the Company
The Company has designated Charoen Pokphand Group Company Limited as the coordinator for matters relating to the Company’s Personal Data protection. If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact information provided below:
Data Protection Officer
E-mail:
cpgroup_compliance@cp.co.th
Address:
Corporate Compliance Office, Charoen Pokphand Group Company Limited
1 Fortune Tower, 17th Floor, Ratchadaphisek Road, Din Daeng, Din Daeng, Bangkok 10400
10. Changes to This Privacy Policy
The Company may make changes to this Privacy Policy from time to time to reflect any changes to our Processing of your Personal Data and to comply with any changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Policy and the amended Privacy Policy through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Policy from time to time.
Document No. CPG-004-FM-CCO-PDPA-TH-01-20220531
This Privacy Policy shall be effective from 1 June 2022
Corporate Governance Office,
Good Governance and Corporate Communication Office.
CHAROEN POKPHAND GROUP CO., LTD.
18 True Tower 27 Fl., Ratchadaphisek Road, Huai Khwang, Bangkok 10310, Thailand
FAQ Privacy Notice Terms and Conditions
Copyright 2022, Sustainable Development, CPG, all right reserved.