OISHI
PRIVACY POLICY
Personal Data Protection Notice for Customers and Activities
Participants
We, Oishi Group Public Company Limited, (the
“Company”) [Thai Beverage Public Company Limited and its subsidiaries (collectively the
“Company”)] recognize and respect the privacy and the protection of personal data of
customers, users and activities participants (collectively “You”). The Company put in
place this Personal Data Protection Notice in order to notify You of the details relating to a collection, use and
disclosure of Your personal data (collectively the “Process”) in accordance with the
personal data protection laws.
1. Purposes of Processing the Personal Data
1.1 The Company will Process Your personal data for the following
purposes:
| Purposes | Lawful Basis | |
| (1) |
Considering applications for purchasing products or receiving services, verifying the
identification, authorization, delegation and receipt of delegation, proceeding pursuant to the
Company’s internal processes for entering into an agreement, performing obligations of the
agreements, delivering products, performing services including communicating, collecting expenses
and delivering relating documents.
|
ContractualLegitimate Interests
|
| (2) |
Applying for using electronic systems or granting the right to access or use the internet or other
electronic working systems.
|
Legitimate Interests
|
| (3) |
Communicating relating to the Company’s products and/or services, registering customers,
responding complaints and finding guidelines for remedying relating to the Company’s products
or services, proceeding according to Your request pursuant to Your rights to Your personal data in
the Company’s possession, managing relationship between the Company and You or Your business,
ensuring the communication information is up-to-date, organizing activities for customers, etc.
|
ContractualLegal ObligationLegitimate InterestsConsent
|
| (4) |
Marketing and developing businesses, communicating the marketing activities, which were analyzed
that they matched Your needs, through any means including
e-mail, telephone, telephone message, social media, letter or fact-to-face communication in order
to improve marketing activities.
|
Legitimate InterestsConsent
|
| (5) |
Evaluating, improving and developing the Company’s products, services and promotions
including surveying satisfaction to the Company’s productions or services in order to be able
to present the appropriate products or services that match Your needs and interests.
|
Legitimate Interests
|
| (6) |
Using as information and documents to support any operation with banks, financial institutions, the
Department of Business Development, the Revenue Department, the Excise Department, the Stock
Exchange of Thailand, the Securities and Exchange Commission and other relevant external
organizations.
|
Legitimate Interests
|
| (7) |
Communicating through various channels such as the Company’s and the companies within the
group’s internal e-mail, website, social media (Facebook, Line, YouTube) or other online media
of the Company or other media such as television, publications, etc.
|
Legitimate InterestsConsent
|
| (8) |
Business planning, reporting and anticipating, managing risks, overseeing an audit including an
internal audit by the internal audit department and an internal management within the organization,
including for the benefits of internal operations within the Company in relation to the payment of
the accounting and finance department.
|
Legitimate Interests
|
| (9) |
Proceeding relating to the assignment of any right, obligation and benefit such as the legit merger
and acquisition, separation or amalgamation.
|
Legitimate Interests
|
| (10) |
Being a database of stakeholders of the Company and/or using the data for managing the relations or
other communications relating to the Company.
|
Legitimate Interests
|
| (11) |
Investigating and inquiring a complaint within the organization, preventing corruption or
proceeding any legal proceeding including inspecting and managing complaints and allegations
relating to the operations of the Company or any related person to ensure transparency and equality
for all parties.
|
Legitimate Interests
|
| (12) |
Recruiting or considering for participating in the Company’s projects or activities such as
observational studies, business visits, acceptance of donations, seminars, training projects or
other projects of the Company or that the Company operates with a third party or government sector,
etc., including any proceeding relating to an activity participation such as submitting response for
lucky draw or delivering rewards.
|
Legitimate Interests
|
| (13) |
Maintaining security around the area of the Company’s building or place and evaluating
security risks including contacting for an issuance of cards for accessing and exiting the
Company’s place and recording images, still and motion, within the Company’s buildings
or offices by using CCTV.
|
Legitimate Interests
|
| (14) |
Creating legal claim, authorization, and receipt of authorization, compliance with laws or
exercising legal rights, litigating including proceeding any action for compulsory execution
according to the laws.
|
Legitimate InterestsLegal Obligation
|
| (15) |
Complying with laws or subpoena, letter or order of authorities, independent organizations or
officers having lawful duties and authorities such as complying with a summon, warrant of seizure,
order of the courts, police officers, public prosecutors and government authorities including
reporting or disclosing information to the shareholders, government authorities or independent
organizations such as the Office of Energy Regulatory Commission, the Ministry of Energy, the
Revenue Department, the Land Department, the State Audit Office, the Office of National
Anti-Corruption Commission, etc., for compliance with relevant laws.
|
Legal Obligation
|
| (16) |
Complying with laws concerning public interest in respect of public health such as health
protection against dangerous communicable disease or epidemic which may be contagious or spread into
the kingdom.
|
Legal Obligation
|
| (17) |
Managing Your hygiene and safety.
|
Preventing or suppressing danger to a person's life, body or health (Vital Interests)
|
1.2 In the event that the Company will Process Your personal data
for any purpose other than the above purposes, the Company may collect Your additional personal data by notifying
You and requesting Your consent from time to time (as the case may be).
2. Personal Data to be Collected
In general, the Company will collect Your personal data by directly
querying You or requesting the data from You; however, there may be some circumstances that the Company may collect
Your personal data from other sources such as government authorities or other sources where Your personal data are
clearly and publicly disclosed including the personal data disclosed via social media, etc. In such case the Company
will collect only the information You choose to be publicly available. In this regard, the type of Your personal
data which will be Processed by the Company will be as follows:
2.1 Once You purchase the products or receive service from the
Company:
(1) Personal information such as name, surname, date of birth, status, address and
other information specified in the identification card or passport;
(2) Contact information such as address, e-mail address, telephone number, online
social media contact information;
(3) Information related to the purchase of products and/or receipt of services such as
record of purchases, claims against the Company for defect of products, record of services received, complaint and
recommendation;
(4) Financial information such as Your bank account, credit/debit card, income,
benefits, record of payments.
2.2 Once You view and/or purchase online products or enter a
website or application including registering for a membership of website, application or benefits cards of the
Company:
(1) Information regarding membership registration such as name, surname, date of birth,
email address, telephone number, username, password, Personal Identification Number (PIN), address, social media
contact channel;
(2) Information regarding Your electronic devices such as IP address, location data,
device identifier, etc;
(3) Type and version of Your web browser including type and version of web
browser’s plug-in;
(4) Time zone.
2.3 Once You participate in the Company’s activity whether
organized by the Company or the Company assigns a third party to organize or the Company participates in organizing
or the Company supports a third party to organize or once You enter into the areas within the Company’s
responsibility:
(1) Personal information using for registering, participating in the activities and
contacting such as name, surname, age, address, telephone number, email address and social media contact channel;
(2) Your images, both still and motion, and/or voices in the areas holding the
activities;
(3) Information of the activities or the incidents You participated in or registered
for;
2.4 Once You contact the Company via customers relations center or
other service units:
(1) Personal information such as name, surname, date of birth, address and other
information specified in the identification card or passport;
(2) Contact information such as address, e-mail address, telephone number, online
social media contact information;
(3) Other information such as record of products/service used, location of the purchase
of products or services and quantity of the products purchased.
2.5 The aforementioned collected personal data is necessary for the
Company to perform according to the agreement or Your request prior to entering into an agreement. If You decline to
provide the Company with the necessary personal data, the Company may not be able to proceed any action relating to
entering into transaction or managing according to the agreement entering into with You (as the case may be).
3. Sensitive Personal Data
3.1 The Company may have to Process sensitive personal data in
accordance with the personal data protection laws for the purposes as notified by the Company according to this
Notice or any other purposes as the Company additionally notify You or as per Your consent provided to the Company
on a case-by-case basis such as:
(1) once the Company has to use the information for the benefit of the Company’s
security such as biometric data, face recognition data and fingerprint data for verifying Your identification;
(2) the Company may collect Your sensitive personal data although the products or
services are not directly relating to the sensitive personal data such as the Company has to use Your identification
card which contains religious information for verifying Your identification;
(3) health information such as food allergy, drug allergy, personal congenital disease,
medical history in case you can claim medical expenses from the Company for using in any activity You participate in
or for public health benefits such as prevention the spread of contagious disease or epidemic, etc.
3.2 The Company will request for Your express consent on a
case-by-case basis for Processing Your sensitive personal data and will provide adequate security measures to
protect Your sensitive personal data.
4. Cookies
In the event that You access any electronic device of the Company
such as applications, websites, information technology and cyber system, etc., the Company uses cookies for
collecting personal data as specified in the Cookies Notice.
5. Withdrawal of Consent and Effect thereof
5.1 In the event that the Company Processes personal data with Your
consent, You have the right to, at any time, withdraw Your consent given to the Company. Such withdrawal will not
affect any Process of personal data performed by the Company prior to the withdrawal of Your consent.
5.2 Your withdrawal of consent given to the Company or refusal to
provide certain information may result in the Company being unable to meet all or certain purposes of the Company as
notified in this Notice or other purposes as the Company additionally notify You or as per Your consent provided to
the Company on a case-by-case basis.
6. Personal Data of Other Persons
6.1 In the event that You provide personal data of other persons to
the Company, You have the following obligations:
(1) to notify such person of the details as specified in this Notice including to
request a consent from such person (if data subject’s consent is required);
(2) to perform any necessary actions in order that the Company is able to legally
Process such person’s personal data.
6.2 Personal data, include sensitive personal data, of other
persons which may be Processed by the Company such as name, surname, date of birth, address, sex, information shown
in an identification card or passport, nationality, e-mail address, telephone number, occupation, position, work
location, financial documents, relationship with You, online social media contact information.
7. Personal Data of a Minor, Incompetent Person and Quasi-incompetent
Person
7.1 In the event that the Company has to obtain a consent for
Processing personal data of a minor, incompetent person or quasi-incompetent person, the Company will be able to
Process personal data of such person only upon the Company’s receipt of a consent of the holder of parental
responsibility over the minor, the custodian or the curator, or the person with authority to give consent in the
name of such person in accordance with the personal data protection laws (as the case may be).
7.2 In the event that the Company has to obtain a consent for
Processing personal data of a minor, incompetent person or quasi-incompetent person but, at that time of data
Processing, the Company is not aware that the data subject is a minor, incompetent person or quasi-incompetent
person, and later becomes aware that the Company had Processed the personal data of such person without consent of
the person with authority to give consent in the name of such person in accordance with clause 7.1, the Company will
erase or destroy the personal data or anonymize the personal data of the data subject which is a minor, incompetent
person or quasi-incompetent person to become the anonymous data which cannot identify the data subject except in the
event that the Company can Process the personal data of such person by using lawful cause and without consent.
8. Period for Retaining the Personal Data
8.1 The Company will retain Your personal data for a period
necessary for achieving the purpose of such personal data Processing unless it is permitted to be retained longer by
any law. If it is unable to be clearly identify the period for retaining the personal data, the Company will retain
Your personal data for a period that can be anticipated in accordance with the collecting standards, by taking into
consideration a business practice for each type of personal data.
8.2 The Company will retain Your personal data collected from the
CCTVs for a period as follows:
(1) In general, the Company will retain Your personal data for a period of 1 year from
the date the CCTV records Your personal data.
(2) In necessary situation such as using as evidence for inquiry, investigation or
legal proceeding or in case of Your request, the Company will retain Your personal data over 1 year from the date
the CCTV records Your personal data and the Company will delete or destroy the personal data or turn Your personal
data into anonymous data once the Company completes such purposes.
8.3 In the event that the Company Processes Your personal data with
Your consent, the Company will Process Your personal data until the Company receives Your withdrawal for such
consent and the Company finishes proceeding with Your withdrawal request. However, the Company will still retain
Your personal data as necessary to make a record that You used to withdraw such consent in order that the Company
will be able to respond to Your request in the future.
9. Disclosure of Personal Data
9.1 The Company may disclose Your personal data to the companies
within the group, any person assigned by the Company to be personal data processors and/or personal data protection
officers, advisors, financial institutes, financial service providers, auditors, external auditors, credit rating
company, partners, business partners, service providers, contractors, sub-contractors who are related to business
operations of the Company to the extent that, associated with personal data, partners who are co-branding with the
Company, any natural persons and/or juristic persons who have relationship or legal relation with the Company, any
persons who are interesting in receiving the assignment of the Company’s rights and obligations, any persons
who intend to have a merger transaction with the Company in any manner, any organization related to sustainability
index, infirmary and/or rescue forces (in case of emergency for protecting Your benefits), government authorities,
regulatory authorities, legal authorities, any persons who request the Company to disclose Your personal data with
legal power and/or in compliance with any agreements You are a party thereto and/or any natural persons or juristic
persons as necessary, whether inside or outside Thailand, (including staff members, employees, executives,
directors, shareholders, agents and advisors of the Company and of the aforesaid recipients) in order that the
Company will be able to operate their businesses and provide services to You including to comply with the purposes
of personal data Processing as specified in this Notice or other purposes as the Company will additionally inform
You or in accordance with Your consent given to the Company on a case-by-case basis and/or to act in compliance with
the laws.
9.2 The Company will cause the recipients of Your personal data to
have appropriate security measures for protecting Your personal data and to Process Your personal data only to the
extent as necessary, and to prevent any use or disclosure of Your personal data by any other persons without lawful
authority.
9.3 The Company will cause the recipients of Your personal data to
keep such personal data in confidence and not use it for any purposes other than the purposes of personal data
Processing under this Notice or other purposes as the Company will additionally inform You or in accordance with
Your consent given to the Company on a case-by-case basis and/or to act in compliance with the laws.
10. Sending or Transferring Personal Data to Foreign Countries
In the event that the Company is required to send or transfer Your
personal data to any foreign country including to keep Your personal data on any database in any foreign country,
the Company will ensure that a transferee or data retention service provider in such destination country has
adequate data protection standard to protect the personal data in accordance with those specified in the personal
data protection laws of the country of transferer of such personal data (if any). If the transferee or data
retention service provider in such destination country has data protection standard to protect the personal data
lower than those specified in the personal data protection laws of the country of transferer of such personal data,
the Company will perform as appropriate and necessary in order that the personal data transferred to such foreign
country will be protected in the same level as the Company protect Your personal data.
11. Security Measures for Personal Data Protection
11.1 The Company will strictly set up the right to access, use,
modify, revise or disclose the personal data including to display or confirm the identity of a person who accesses
or uses the personal data in compliance with the standards for safeguarding the personal data as specified in the
personal data protection laws.
11.2 The Company will set up an appropriate technological procedure
to prevent any access to information technology system which collects personal data without permission.
11.3 In the event that the Company discloses Your personal data to
any third person, the Company will perform any action to prevent such person from illegal or unauthorized use or
disclosure of the personal data so that such person will only use Your personal data as necessary and in accordance
with the purposes as the Company notifies You and/or in accordance with Your consent on a case-by-case basis.
11.4 The Company will set up a monitoring system for erasing or
destroying personal data from the collecting system once the retention period for such personal data ends or once
such personal data is excessive or no longer related to the data processing purposes or upon Your request or
withdrawal of consent.
11.5 In the event that there is a violation of the Company’s
security measures for personal data which causes an infringement of Your personal data, the Company will, without
delay, notify such infringement to a competent authority as specified in the personal data protection laws unless
there is no risk that such infringement will affect Your personal rights and freedom. If there is high risk that
such infringement will affect Your personal rights and freedom, the Company will, without delay, notify You of such
infringement together with remedial guidelines in accordance with the criteria and procedures specified in the
personal data protection laws.
11.6 The Company will record any transactions as specified in the
personal data protection laws in writing or on electronic system so that the data subject or any authority under the
personal data protection laws be able to make an examination thereon.
12. Rights of Data Subject
12.1 You, as a data subject, have the rights to deal with Your
personal data which are in the Company’s responsibility in accordance with the personal data protection laws
as follows:
(1) to request access to or obtain copy of Your personal data or to request the
disclosure of the acquisition of Your personal data without Your consent;
(2) to obtain Your personal data in electronic form or transfer Your personal data to
other persons;
(3) to object to the collection, use, or disclosure of Your personal data in accordance
with the personal data protection laws;
(4) to erase or destroy Your personal data, or to anonymize Your personal data to
become the anonymous data which cannot identify You in accordance with the personal data protection laws;
(5) to restrict the use of Your personal data in accordance with the personal data
protection laws;
(6) to revise or modify Your personal data to be accurate, up to date, complete and not
misleading;
(7) to withdraw Your consent given to the Company unless there is any restriction for
consent withdrawal by laws or any agreement which gives benefits to You;
(8) to complain to any authority if You believe that any dealing with the personal data
by the Company is incompliance with the personal data protection laws.
12.2 You can use the right as specified in clause 12.1 by
contacting the person specified in clause 14 hereof.
12.3 The Company reserves the right to refuse to perform according
to Your request, whether in whole or in part, if the Company has reasonable and lawful reason such as such
performance will cause unreasonable burden to the Company, is impracticable, is illegal or the use of such right by
You will or may affect other person’s rights or freedom or in the event that the Company has a legal authority
to collect Your personal data without Your consent.
13. Privacy Notice or Privacy Policy of other Websites or
Applications
In the event that You use the Company’s websites or
applications and You clicks any link shown on such websites or applications to enter into other websites or
applications, whether such other websites or applications belong to the Company or not, You are required to learn
and comply with the Privacy Notice or Privacy Policy of such other websites or applications, and the Company will
not be responsible for any contents or data protection standards to protect the personal data of such other websites
or applications. Moreover, if You give Your personal data to the owners of other websites or applications, You
acknowledge and understand that the Company is not relevant to processing of Your personal data by the owners of
such other websites or applications.
14. Details of Personal Data Controller and Personal Data Protection
Officer
You can contact the personal data controller and/or personal data
protection officer of the Company through the following channels:
PDPA Contact Center
Tel. 02-975-5566 or Email. pdpa_info@thaibev.com
15. Revision of Personal Data Protection Notice
In the event that there is any revision to this Notice, the Company
will make an announcement via the Company’s website or application, or other communication channels of the
Company and the new Notice will be effective on the date of such announcement.