Privacy Notice For the Business Partners and Those Who Have Business Relationship | Sansiri

Privacy Notice

For the Business Partners and Those Who Have Business Relationship

Sansiri Public Company Limited, subsidiaries and/or joint venture (hereinafter referred to as “Sansiri” or “we”) has placed the great importance on personal data protection of the business partners and those who have the business relationship (collectively referred to as “you”), and, to ensure that we will provide a protection to and handle your personal data in consistency with the personal data protection laws, we therefore establish this Privacy Notice to notify all relevant persons the details of personal data handling, whether collection, use, and disclosure (collectively referred to as “processing”) which may be done, as well as to notify you your rights on personal data and our contact channels.

1. Type of Persons Which We Collect the Personal Data

Under this Privacy Notice, Sansiri collects personal data of the following persons.

• 1.1 1.1 Business partner means a person who will sell or have sold the products and/or services to Sansiri, whether have been registered as a business partner of Sansiri or not, such as contract party, service provider, consultant, and so on, and shall include any individual being involved with or representing the juristic person which is a business partner, such as executive, director, officer, employee, agent, representative, or any other individual, and a person whose personal data appears in various documents in connection with transactions between Sansiri and such juristic person, such as coordinator, supplier, check payer, and so on, including a person whose personal data is provided to Sansiri by such juristic person.
• 1.2 1.2 Person who has business relationship means other person, who is not a business partner or a person working for Sansiri group, who have relationship with respect to business operation, such as a person working for government agency having supervisory authority for business operation or supervision the legal compliance, a person who is interested in a business project or participating in the business project, a person who is interested in investment or joint venture, agent or broker for providing products or services to Sansiri, and shall include any individual being involved with or representing such juristic person, such as executive, director, officer, employee, agent, representative, or any other individual, and a person whose personal data appears in various documents in connection with transactions between Sansiri and such juristic person

2.  Objectives of Collection, Use or Disclosure of Personal Data

• 2.1 In general, whether you are a business partner or a person who has business relationship, Sansiri may process your personal data for the following objectives.
  
  

  No.	Objectives	Lawful Basis
  1.	For the coordination relating to business operation of Sansiri.	For legitimate interests (Legitimate Interests)
  2.	For collecting and using your personal data, namely name-surname, position, organization, and photograph-motion in connection with the performance and activities of Sansiri for public relation through various channels, such as internal email of Sansiri and group companies, Sansiri’s website, Facebook, LINE, YouTube, or other online media of Sansiri or other media, such as television, printing media, and so on.	For legitimate interests (Legitimate Interests)
  3.	For applying to access and use the electronic system or opening the accessing right or the use of internet or various electronic system.	For the performance of a contract (Contractual Basis)
  4.	For proceeding with planning, reporting, and forecasting the business, risk management, supervision, and inspection, including internal inspection of the Internal Audit Office and internal management of the organization, as well as for benefits of internal operation of Sansiri relating to disbursement of the financial accounting department of Sansiri.	For legitimate interests (Legitimate Interests)
  5.	For operating in connection with Know Your Customer and/or Due Diligence relating to the operation of Sansiri, including other forms of checking the business status or background for evaluating the suitability or risk consideration before engaging in various transactions, the proof and verification of identity, and/or checking the authority, authorizing and acceptance of authority for signing in any agreement or contract with Sansiri.	For the performance of a contract (Contractual Basis) For legitimate interests of the Data Controller (Legitimate Interests) For complying with the law (Legal Obligation)
  6.	For operating in connection with the transfer of rights, obligations, and any benefits, such as merger and acquisition, demerger, or business transfer or any operation legally proceeded	For complying with the law (Legal Obligation)
  7.	For concluding the database of stakeholders of Sansiri and/or for relationship management or coordination relating to Sansiri, including opinion surveying for analyzing and improving the operation of Sansiri.	For legitimate interests (Legitimate Interests)
  8.	For disclosure the information necessary for complying with various evaluations which Sansiri engaged.	For legitimate interests (Legitimate Interests)
  9.	For investigating, examining the internal complaint of the organization, preventing the corruption, or proceeding with any other legal proceedings, including checking and managing the complaint and accusation relating the operation of Sansiri or relevant person to ensure the transparency and justice for every party.	For legitimate interests (Legitimate Interests)
  10.	For accepting the application or considering for approval of participation of the project or various activities of Sansiri, such as study trip, business visiting, acceptance of donation, seminar, training project or other projects of Sansiri or any project which Sansiri co-operates with the third party or government agencies, and so on, including any operation relating to participation of the activities, such as quiz competition, delivery of the award, as well as the evaluation, analyzation and improvement of operation of the project or activity.	For legitimate interests (Legitimate Interests)
  11.	For security around building, the place, and the project of Sansiri, including card exchanging prior to the access of such area, the record of a person contacting with Sansiri, or the building, the place, and the project of Sansiri by CCTV.	For legitimate interests (Legitimate Interests)
  12.	For establishing the legal claims, authorizing, and accepting the authorization, complying with or exercising the legal claims, or defending the legal claims, proceeding with lawsuit, as well as proceeding with legal execution.	For legitimate interests (Legitimate Interests) For complying with the law (Legal Obligation)
  13.	For complying with the law or complying with the court writ, a letter, or an order of government agencies, independent entity or competent authorities, such as to comply with the summons, writ of attachment of claims, an order of the court, the police officer, the public prosecutor, government agency, including a report or disclosure to the shareholders, government agencies, or independent entities, such as the Revenue Department, the Land Office, Office of the National Anti-Corruption Commission, and so on, for complying with the relevant laws.	For complying with the law (Legal Obligation)
  14.	When you access and use our social network media, such as Facebook, LINE, YouTube, and other online media, Sansiri may collect, use, or disclose your personal data for the following objectives. (a) For evaluating the performance and analyzing the market survey and market strategies, including planning, reporting, and forecasting the business. (b) For conducting a poll, analyzing, researching, and developing the products and services, including various activities of Sansiri to be more suitable to your needs, and for developing the public relations to be more suitable to your needs. (c) For conducting the risk management, supervision, inspection, as well as for the internal inspection of the Internal Audit Office and internal management of the organization, such as for examining and preventing the corruption, and so on. (d) For contacting and acquiring additional information, investigating complaints, managing of complaints, recording the performance, and performing in accordance with the internal procedures of Sansiri. (e) For selecting the activity participant, conducting quiz competition through online channels, announcing the result of activity, giving awards to the participants according to the conditions specified by Sansiri, including storing in the database regarding the profile of participants of Sansiri’s activities.	For legitimate interests (Legitimate Interests)
  	(f) For complying with the laws, investigating, and examining in accordance with legal process and any other regulations, and reporting or disclosing the information to government agencies, or any other entities which operate by the virtue of law, or the court’s order, as well as for establishing a legal claim, complying with or exercising the legal claims or defending the legal claims.	For complying with the law (Legal Obligation)

  In addition to the above objectives, Sansiri may additionally process your personal data for the following cases.

• 2.2 In case you are a business partner, Sansiri may additionally process your personal data for the following objectives.
  
  

  No.	Objectives	Lawful Basis
  1.	For proceeding with various procedures before conclusion of contract, such as Business partner registration Consideration of business partner’s qualification Preparation of information prior to the procurement process, such as surveying and setting the middle price, specifying the name and details of business partners in the internal system of Sansiri, and so on. Purchasing or receiving the procurement form, attending the clarification session, presenting the achievement relating to procurement (on a case-by-case basis), price negotiating, announcing the winner./li> Bid invitation, bid proposal, checking the authority, authorizing and acceptance of authority for filing bid proposal of the bidder and considering qualification of bidder who files a proposal to Sansiri in accordance with procurement process of Sansiri, including the case which bidder is a service provider, legal consultant, accounting consultant, business consultant and tax consultant, auditor, financial consultant, financial institute, consultant on the development of accounting and financial system. Making a confidentiality agreement	For the performance of a contract (Contractual Basis) For legitimate interests (Legitimate Interests)
  2.	For the necessity of transactions between business partner and Sansiri, such as Verifying the identity, checking the authority, authorizing and acceptance of authority, including being supportive documents for relevant transactions. Complying with various rules, regulations, and internal procedures of Sansiri. Considering, making, and signing the commercial contract. Complying with employment contract, service contract, other commercial contract, and other relevant agreement or cooperation between Sansiri and the party, including the process of requesting and considering the relevant documents which the personal data of company director, who is a third party or representative from the government agency, may be included therein. Inspecting and accepting the work in accordance with the contract between Sansiri and business partner, managing of supplies and commercial goods, issuing the certificate of work, until the process is complete.	For the performance of a contract (Contractual Basis)
  3.	For complying with the laws relating to the transaction between Sansiri and business partner, such as the law relating to procurement of the government agencies, tax law, law relating to the examination of privilege on the land, law relating to the state audit, law relating to the securities and exchange, and law relating to official information.	For complying with the law (Legal Obligation)

• 2.3 In case you are a person who has business relationship, Sansiri may additionally process your personal data for the following cases.
  
  

  No.	Objectives	Lawful Basis
  1.	For business communication, such as contacting, making an appointment, visiting, meeting, business meeting and talking with respect to the products or services and various projects of Sansiri or other project relating to Sansiri, including recording the details of such communication.	For legitimate interests (Legitimate Interests)
  2.	For checking the qualification or evaluating the suitability before entering into the transaction, considering the risk for engagement in relevant transactions, the proof and verification of identity, and/or checking the authority, authorizing and acceptance of authority for signing in any agreement or contract with Sansiri, proceeding with due diligence or other forms of checking the background, and complying with various internal procedures of Sansiri.	For legitimate interests (Legitimate Interests)
  3.	For considering, making, and signing various relevant contract or agreements, including managing such contract or agreements.	For the performance of a contract (Contractual Basis)
  4.	For considering for approval of participation of Sansiri’s or any project which Sansiri co-operates with the third party or government agencies, and any operation relating to such project.	For legitimate interests (Legitimate Interests)

In case the personal data which Sansiri collects, for the above objectives, is necessary for the performance of a contract or for compliance with various applicable laws, if you do not provide such necessary information, Sansiri may not be able to consider for entering the transaction or managing in accordance with the contract with you (as the case may be).  

Furthermore, in case you provide personal data of others to us, you shall be responsible for notifying such persons this Privacy Notice and/or obtaining the consent (if necessary).

3. Personal Data Which Will Be Collected

Generally, to collect your personal data, Sansiri will collect the personal data by requesting or asking for such information directly from you. However, in some cases, Sansiri may collect your personal data from other sources, such as your affiliation company, your employee, secretary or coordinator, government sectors or government agencies, or other publicly available sources, such as websites, the information can be searched on the internet, and so on.

In this regard, Sansiri collects your personal data, as follows.

• 3.1 General Personal Data
  
  
  • Information enables the identification of a person (Identity Data), such as name, surname, national ID card number, passport number, date of birth, gender, age, nationality, signature, photograph, professional license number, information of driving license, username of electronic system (Username), and so on.
  • Contact information (Contact Data), such as address, copy of house registration, telephone number, facsimile number, email, geolocation, emergency contact, social network account, LINE ID, secretary information, and so on.
  • Financial information (Financial Data), such as bank account number, and so on.
  • Information with respect to communication with Sansiri (Communication Data), such as information regarding date, time, and place of communication with Sansiri, video and audio recordings when contacting with Sansiri, and so on.
  • Information with respect to the company or agencies which you are working with, such as affiliation company or agency, working place, position, and so on.
  • Information with respect to educational background, working background, trainings, expertise, and various achievements, and so on.
  • Information with respect to personal interest.
  • Video recording by CCTV.
  • Information with respect to participation of the meetings between Sansiri and group companies, including the information regarding the participation of the trainings, seminars, activities, or other projects arranged by Sansiri which the record of still photos, motion, and/or sounds may be proceeded during such meeting, training, seminar, or activity.
  • Other information necessary for background check, evaluation of suitability or risk consideration before entering into the transaction, including for proceeding with lawsuit or legal execution, such as marital status, property information, and so on.
  • Opinion, recommendation, complaints.
  • Activity history or history on participation in various projects of Sansiri.
  • Information with respect to screening in accordance with epidemic prevention measures.
  • Information with respect to the use of various electronic systems of Sansiri, including information regarding the use of Application, website visiting (Browsing Information), such as website browsing history, IP address, and so on.
  • Other personal data for facilitation as necessary, such as your preferred food or beverage, and so on.
• 3.2 Sensitive Personal Data
  
  

  In general, Sansiri does not desire to collect and use the information pertaining to religious beliefs and blood type specified on your copy of national ID card for any objective in particular. In case you provide a copy of national ID card to Sansiri, please hide such information. In case you do not hide aforementioned information, it shall be considered that you give a consent to Sansiri to hide such information and it shall be considered that the document having such hidden information is valid and enforceable in accordance with the law in all respects. In this regard, if Sansiri is unable to hide the information due to some technical restriction, Sansiri will collect and use such information as only for a part of your identity verification.

  In the case where it is necessary to Sansiri to collect your sensitive personal data, Sansiri will request for your explicit consent, on a case-by-case basis, unless otherwise specified by law.

  Sansiri may process the following sensitive personal data.

  • Information pertaining to religious beliefs.
  • Health data and/or disability.
  • Information pertaining to racial.

4. Retention Period

Sansiri will retain your personal data for the period as necessary for performing the objectives of collection, use or disclosure of the personal data specified herein. The criteria for determining the retention period are the period which Sansiri still needs to use your personal data in accordance with the objectives and may continue to retain as the period necessary for complying with the laws, or legal prescription, or for the establishment, compliance or exercise of legal claims, or defense of legal claims, or for other cases according to the policy and internal regulations of Sansiri.

5. Disclosure of Personal Data

For performing the objectives specified in this notice, Sansiri may disclose your personal data to the following third parties.

• 5.1 Group companies of Sansiri.
• 5.2 Government sectors, supervisory authorities, state enterprises, government agencies, public organization, independent entities established in accordance with the law, or other entities prescribed by laws, including the competent officials, such as the court, the police officers, the Revenue Department, the Land Office, the District Office, the Provincial Office, the Securities and Exchange Commission of Thailand, the Anti-Money Laundering Office, the Department of Skill Development, the Department of Labour Protection and Welfare, the Office of the Ombudsman of Thailand, the State Audit Office of the Kingdom of Thailand, the House of Representatives Affairs Committee, the Senate Committee, the Legal Execution Department, the Office of the Attorney General, the State Audit Office of the Kingdom of Thailand, the Office of the National Anti-Corruption Commission, and so on.
• 5.3 Agencies, organizations or persons relating to the exercise of legal claims, lawsuits, objection of the complaints or accusation, litigation of Sansiri, such as litigants, and so on.
• 5.4 Agents, contractor/subcontractor and/or service provider performing any operation for Sansiri, such as professional consultants, transportation service providers, contractor performing marketing activities, the company providing accommodations and traveling, the companies organizing the activities, trainings, or seminars, media production contractor, contractor performing public relation activities, insurer, auditor, legal consultant, and so on.
• 5.5 A person having business relationship (in the case where it is necessary for the performance of contract when the project or business is co-operated).
• 5.6 Certification institutes for the management system standards.
• 5.7 Training participants.
• 5.8 Shareholders, bondholders, and representatives of such persons.
• 5.9 Bank or financial institutes.
• 5.10 Assignee of the rights, obligations, and any benefits from Sansiri, including authorized person of such assignee, such as restructuring, merger and acquisition, demerger, or business transfer, and so on.
• 5.11 Other third party, such as announcement of the list of selected candidates through social media channels of Sansiri or publication of photographs of activities or activity news or project news of Sansiri to the mass media and third party, and so on.
• 5.12 Hospital or sanatorium.

6. Transfer or Disclosure of Personal Data to Other Countries  

In some cases, we may be required to disclose your personal data to the other countries, which the standards of personal data protection may be different from Thailand, for the following objectives.

• 6.1 Sansiri facilitates the operation of transactions in accordance with your preference.
• 6.2 Sansiri operates the business or proceeds with various transactions with companies located in other countries. Therefore, it is necessary to disclose personal data, for your benefit, to such companies.
• 6.3 Sansiri may be required to disclose your personal data to, including, government agencies, professional consultants, and any person relating to and necessary to access such personal data for normal business operation of Sansiri which is in consistency with your preference, as well as the data may be disclosed to the other countries for proceeding with lawsuit or arbitration that may be done in the future.
• 6.4 Sansiri may store your personal data in the computers, servers, or clouds of service providers located in other countries, and may process information by using package software or application of service providers located in other countries.

7. Your Rights as a Data Subject

As you are a data subject, you have the rights as prescribed by the Personal Data Protection Act, B.E.2562 (2019). In this regard, you can exercise your various rights through the channels which Sansiri specifies in Clause 9 or through Sansiri’s website. You are entitled to exercise the rights when the personal data protection law is enforced. Your rights are as follows.

• 7.1 Right to withdraw the consent (Right to Withdraw Consent)

  In case Sansiri requests for your consent, you are entitled to withdraw the consent for processing of personal data given to Sansiri, unless such withdrawal of consent is restricted by law or contract which is beneficial for you.

  
  

  In this regard, the withdrawal of consent shall not affect any processing of personal data which the consent was already legally given by you.

• 7.2 Right to access to the personal data (Right to Access)

  You are entitled to request for accessing and obtaining a copy of your personal data, which is under responsibility of Sansiri, including request Sansiri to disclose the acquisition of such information which you do not consent to Sansiri.

• 7.3 Right to request for sending or transferring of personal data (Data Portability Right)

  You are entitled to request Sansiri to transfer your personal data provided to Sansiri in accordance with the laws.

• 7.4 Right to object the collection, use or disclosure of personal data (Right to Object)

  You are entitled to object to the processing of information relating to you for the collection, use or disclosure of personal data that is prescribed by law.

• 7.5 Right to erase the personal data (Erasure Right)

  You are entitled to request Sansiri to erase your personal data as prescribed by law. However, Sansiri may collect your personal data by electronic system which some of the system may be unable to be erased. In such case, Sansiri will destroy or anonymize such personal data to become anonymous data that cannot identify you.

• 7.6 Right to request for restriction of the use of personal data (Right to Restrict Processing)

  You are entitled to request Sansiri to restrict the use of your personal data as prescribed by law.

• 7.7 Right to request for correcting the personal data (Rectification Right)

  In case you opine that the information possessed by Sansiri is incorrect or you have changed your personal data, you are entitled to request Sansiri to correct your personal data so that your such personal data will be accurate, up-to-date, complete, and not misleading.

• 7.8 Right to lodge a complaint (Right to Lodge a Complaint)

  You are entitled to lodge a complaint to the competent authority in accordance with the Personal Data Protection Act, B.E.2562 (2019) in the event that Sansiri violates or does not comply with such Act.  

  You can proceed with the exercise of above specified rights by notifying through the Call Centre, telephone no.1685 which you will be required to file the request for exercising the right of data subject (download), including verify your identity for exercising such rights in accordance with the methods and procedures specified by the Company. In this regard, the Company will consider and inform you of the result of consideration of your request within 30 days from the date which the Company received such request.

8. Amendment of this Notice

We may occasionally amend this Privacy Notice and, if there is such amendment, we will announce it on Sansiri’s website. In this regard, in case it is necessary to request your consent, we will proceed with requesting the consent from you additionally.

9. Contact Methods

If you have any questions or would like to ask for more information regarding the protection of your personal data, the collection, use or disclosure of your personal data, the exercise of your rights, or any complaints, you can contact Sansiri at the following channels.

Sansiri Public Company Limited 
Data Protection Officer

Contact place: 59 Soi Rim Khlong Phra Khanong, Phra Khanong Nuea Sub-district, Vadhana District, Bangkok 10110
Telephone no.: 1685
Email: cs@sansiri.com