Personal Data Privacy Notice of HANA Microelectronics Group and Subsidiaries
HANA Microelectronics Public Company Limited and its affiliates “The Company” values your privacy and strives to protect your personal data and personal data of persons related to your business collectively referred to as “Personal Data” in accordance with Thai law and in order to comply with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) that will come into effect on 1 June 2022.
To ensure you that we will protect and manage your personal data in accordance with the laws concerning personal data protection, we then establish this Personal Data Privacy Notice for your acknowledgement of details of the processing of personal data, in term of the collection, use and disclosure (collectively referred to as the “Processing”) that may be occurred and also inform you of the rights on your personal data and our contact channels.
1. Types of persons that we collect the personal data
Under this Personal Data Privacy Notice, the company shall collect the personal data of the following persons:
1.1 Customers means who purchases or will purchase or the company’s product and/or services, and also including any individual who relates to or is representative of any juristic person who is the customer, such as the executive, director, officer, employee, agent or any other ordinary person, and the person having his/her personal data appeared in relevant documents in relation to the conducting of transaction between the company and such juristic person such as the person issuing purchase order, the person receiving product and the cheque payer, etc. including a person that such juristic person has provided data to the company.
1.2 Trade Partner(s) means the person who sells or will sell product and / or provide service for the company such as the contractual party, service provider and advisor and shall mean to include an ordinary person who is related to or is a representative or the juristic person which is a trade partner such as the executive, director, employee, staff, agent, representative or any other ordinary person, and the person having his/her personal data appeared in relevant documents in relation to the conducting of transaction between the company and such juristic person such as the coordinator, the person delivering the product and the cheque payer, etc. including a person that such juristic person has provided data for the company.
1.3 Person(s) Having Business Relation means the person who is not a customer, trade partner or the operator in the company that has relationship in the manner relating to the conduct of business such as the person who performs his/her duty in the government authority which regulate the conduct work compliance with laws, the person interested to participate in business project or the business project participant, the person interested making a joint investment or the co-investor, the agent or broker for the procurement of product or service for the company, and including an ordinary person who is related to or is an agent of such juristic person such as the executive, director, employee, agent, representative or any other ordinary person, and the person having his/her personal data appeared in relevant documents in relation to the conducting of transaction between the company and such juristic person.
1.4 Operator(s) in Hana Microelectronics Group means the director, student trainee, employee or other personnel of the companies in Hana Microelectronics Group
1.5 Job applicants applicants means persons who may be selected to be personnel of the company. The company may directly collect personal data of the job applicants by itself or from the third party. Their personal data are contained in the documents relating to the job applications, such as family members, reference person etc.
1.6 General Public Public means any person apart from the above categories or the person whose personal data is processed by the company such Personal Data is directly received by the company, automatically collected through the use of Cookies or other technologies, or provided by a third party. An Example of such person includes a person whose image is recorded by CCTV or who accesses the Company’s website, etc.
2. Personal Data which shall be collected
In general, the company shall collect your personal data by directly requesting the data from you; nonetheless, there may be some circumstances that the company collects your personal data from other sources such as from the company that you are positioned in, government authorities or other sources of publicly disclosed information such as website and searchable data on the internet, etc. In this regard, the company shall proceed to collect your personal data as follows:
2.1 General personal data
(1) Identity data such as first name, last name, identification card number, passport number, date of birth, gender, age, nationality, signature, photo, identity number of the professional license, Employee ID (only for the case of an employee of companies in HANA Group), driving license, etc.
(2) Contact data such as address, a copy of house registration, phone number, facsimile number, email, Geolocation, emergency contract person, social media account, LINE ID, secretary information, etc.
(3) Financial data such as bank account number, tax invoice, delivery note, cheque and cheque stub, receipt.
(4) Communication data with the company such as information concerning date, time and place having contact with the company, information of the recording of video or voice upon having contact with the company, etc
(5) Data regarding companies or authorities that you are working in, such as name of companies or authorities that you are working in, working location, etc.
(6) Data regarding educational profile, work profile, training, proficiency and relevant achievements, etc.
(7) Data regarding personal preferences and interest.
(8) Closed-circuit television (CCTV) Recording.
(9) Data on the participation of meetings between the company and group companies including data on the participation of trainings, seminars, activities or other projects held by the company as there may be the recording of photo, video or voice during such meetings, trainings, seminars or activities.
(10) Other necessary data for the legal proceeding or legal execution such as marriage status and data concerning assets, etc.
(11) Opinions, recommendations and complaints.
(12) Screening data pursuant to communicable disease prevention measures.
(13) Data regarding performance and assessment of employees.
(14) Data regarding benefits, remuneration and working time record.
(15) Technical Data, such as a log file, IP Address, and information that the company collects through the use of Cookies or other similar technologies.
2.2 Sensitive personal data
Basically, the company has no intention to collect and use religious and blood type data specified in your identification card for any specific purpose. In the event that you provided the company the copy of your identification card, it is requested that you conceal such data. If you did not conceal such data, it shall be deemed that you authorized the company to conceal those data and it shall be deemed that such document with concealed data be valid and legally enforceable in all respects. In case that the company is unable to conceal those data due to some technical limitation, the company shall collect and use such data as a part of your identification documents only.
If it is necessary for the company to collect your sensitive personal data, the company shall be able to perform the processing of such data by relying on lawful basis, and the company shall inform the specific purpose and shall request for your express consent on case-by-case basis.
3. Purposes for the collection, use and disclosure of personal data
3.1 In general, whether you are a Customer, Trade Partner, the Person Having Business Relationship or the Operator in HANA Group, the company may proceed on the Processing of your data on the following purposes:
| Clause | Purposes | Lawful Basis |
|---|---|---|
| (1) | For contacting and coordination in relation to the business operation of the company. | Legitimate interest basis and Legal obligation basis |
| (2) | For the collection and use of your personal data such as name-surname, position, work unit and/or picture or video in relation to the operations and activities of the company for dissemination or public relations through relevant channels such as internal email of the company and group companies, the company’s website, Facebook, LINE, YouTube or other online media of the company or other media such as television and publication, etc. | Legitimate interest basis, Contractual basis, Legal obligation basis and Consent basis |
| (3) | For the compliance with relevant laws, orders of the authorities, independent organizations or the officers having duties and authorities according to the laws. | Legal obligation basis |
| (4) | For the compliance with laws concerning public interest in respect of public health such as health protection against dangerous communicable disease or epidemic which may be contagious or spread into the kingdom. | Legal obligation basis, Preventing or suppressing danger to person’s body, or health basis |
| (5) | For maintaining security in building area, premises of the company including the exchange of Identity cards for the entry and exit of such area, the CCTV recording of the company or the buildings. | Legitimate interest basis, legal obligation basis and Preventing or suppressing danger to person’s body, or health basis |
| (6) | For the compliance, exercise or defense of legal claim, or for commencing relevant legal proceedings including for using as supporting evidence of the legal proceeding (if any) against the related person as well as the proceedings for legal execution. | Legal obligation basis |
Other than the above purposes, the company may further proceed on processing of your personal data for the relevant cases as follows:
3.2 In case that you are a Customer, the company may proceed on processing of your personal data for additional relevant purposes as follows:
| Clause | Purposes | Lawful Basis |
|---|---|---|
| (1) | To verify your identity or your authority in representing any person who has a transaction with us before signing contact agreement, to purchase products and/or use the services of the Company or others. | Contractual basis and legitimate interest basis |
| (2) | To manage customer’s order, prepare products and/or services and any other related activities. | Contractual basis and legitimate interest basis |
| (3) | To use as information and supporting documents for any transaction with banks, financial institutions, Department of Business Development, Revenue Department, Excise Department, Stock Exchange of Thailand, the Office of Securities and Exchange Commission and other relevant external authorities. | Legitimate interest basis, Legal basis |
| (4) | To changes customer’s detail in the Company's system. | Legitimate interest basis |
3.3 In case that you are a Trade Partner, the company may proceed on the Processing of your personal data for additional relevant purposes as follows:
| Clause | Purposes | Lawful Basis |
|---|---|---|
| (1) | To verify your identity and authority to act on behalf of your company, before signing any agreement, such as qualification consideration, information preparation before procurement process, purchasing, bidding, listening to the clarification, attending to the presentation relating the procurement works , agreement letter etc. | Contractual basis and legitimate interest basis |
| (2) | To conduct the transaction between Trade Partner and The Company such as identity and authority verification, granting or obtaining of authority, proceeding in accordance with the rules and regulations and relevant internal procedures of The Company, compliance to the hiring agreement, service agreement, other commercial agreements, and relevant agreements or cooperation between The Company and Trade Partner. | Contractual basis, legitimate interest basis and Legal obligation basis |
| (3) | To comply with relevant laws concerning the conducting of transactions between Trade Partners and The Company such as the laws concerning taxation, laws on the inspection of rights and benefits of the land, laws concerning state audit, laws concerning securities and exchange and laws concerning official information. | Legal obligation basis and Contractual basis |
3.4 In case that you are a Person Having Business Relationship, the company may proceed on the Processing of your personal data for additional relevant purposes as follows:
| Clause | Purposes | Lawful Basis |
|---|---|---|
| (1) | For business communication such as having business contact, appointment, attendance, conference, meeting and converse in relation to products or services and relevant projects of the company. | Legitimate interest basis |
| (2) | To verify an appropriateness before making a decision to enter into business transaction, risk assessment. To verify identity and authority, granting and obtaining of authority before entering into any execution of the agreement with the Company. | Legitimate interest basis, Legal obligation basis and Contractual basis |
| (3) | To consider the preparation, the signing of any contract or agreement, as well as the execution of such agreement with The Company. | Contractual basis and Legitimate interest basis |
| (4) | To Comply with laws and regulations related to business transaction between The Company and the third party, such as Tax Revenue Law, Land Benefit Check Law, Securities and Stock Exchange Law. | Contractual basis , Legal obligation basis and Legitimate interest basis |
3.5 In case that you are job applicants and student trainee, the company may proceed on the Processing of your personal data for additional relevant purposes as follows:
| Clause | Purposes | Lawful Basis |
|---|---|---|
| (1) | For recruitment, job applicant interview, or any actions related to job application For necessary communication on recruitment process For evaluation of the applicant’s qualification and appropriateness to the position required For recording The Company’s employment process | Legitimate interest basis and Consent basis |
| (2) | The Company may collect, use, or disclose Personal Data of the job applicant, or of his/her family member, or of other persons, provided by the job applicant. Such actions must comply with the law and be considered necessary or an emergency, for instance, checking Personal Data of the job applicant or student trainee from the referee, or checking the working record from the former employer, before reporting the incident or accident happened. | Legal obligation, Legitimate interests Contractual basis and Consent basis |
| (3) | For necessary or emergency communication, such as the checking of Personal Data of the job applicant or student trainee the referee or checking the working record from the former employer. | Legitimate interests and Consent basis |
3.6 In case that you are an Operator in HANA Group, the company may proceed on the Processing of your personal data for additional relevant purposes as follows:
| Clause | Purposes | Lawful Basis |
|---|---|---|
| (1) | For management of Compensation, welfare , benefits , medical expense reimbursement, physical examination and insurance etc. | Contractual basis, Legitimate interest basis and Legal obligation basis |
| (2) | For the purpose of the performance of duty of employee according to the employment, employment agreement, or any other contracts entered into with the company. | Contractual basis, Legitimate interest basis and Legal obligation basis |
| (3) | For the compliance with relevant law of Human Resources management and company and lawful orders of government agencies and relevant officials | Contractual basis, Legitimate interest basis and Legal obligation basis |
| (4) | For the purpose of performance appraisal management | Contractual basis, Legitimate interest basis and Legal obligation basis |
| (5) | For the purpose of training management | Contractual basis,Legitimate interest basis and Legal obligation basis |
| (6) | For the advantage of personnel transfer In case of having to transfer personal data abroad The company will take steps to ensure that the destination country or the recipient has adequate personal data protection measures. In some cases, the Company may require consent. This is to comply with the rules of the law on personal data protection. | Contractual basis, Legitimate interest basis, Legal obligation basis and Consent Basis |
3.7 In case that you are a shareholder, the company may proceed on the Processing of your personal data for additional relevant purposes as follows:
| Clause | Purposes | Lawful Basis |
|---|---|---|
| (1) | For attend the shareholders’ meeting For allow you to exercise your rights as shareholders through a ballot or appointment of a proxy. For the registration of the Company’s shareholder registration book, including keeping information up to date. For pay dividend For communicate with you about a shareholder with related information, including a letter to shareholders , meeting invitation letters etc. | Contractual basis, Legitimate interest basis and Legal basis |
| (2) | For provide your personal information to authorized persons including the share registrar and securities register in order to benefit the managing of you shareholding on behalf of the company. For internal audit purposes and efficient business management of the Company. For comply with legal requirements. | Contractual basis, Legitimate interest basis and Legal basis |
4. Period for retention of personal data
The company shall retain your personal data for the period necessary for the purposes of the collection, use or disclosure of personal data set out in this Privacy Notice. The period necessary for the company to utilize your personal data in accordance with the purposes are not over than 10 years and it shall be further retained pursuant to the period necessary for the compliance with laws or the statutory prescription period, or for the establishment, compliance, exercise or defense of legal claim, or for other reasons pursuant to the internal policies and rules in the organization of the company.
5. Use of Cookies
The data subject may use features offered on Hana Group websites such as About, Worldwide Manufacturing and Product Information, Investor Relations and Careers page. Nevertheless, The personal information such as ISP name or the searching history will be stored by Cookies or other program in statistic form on behalf of the companies for the purpose of improving our website performance.
6. Disclosure of personal data
In order to carry out the proceedings for the purposes set out in this Privacy Notice, the company may disclose your personal data to the third parties as follows:
6.1 Companies in HANA Group;
6.2 The government authorities, regulatory authorities, state enterprises, state authorities, public organizations, independent organizations established under the laws or other authorities as prescribed by laws including the officers which exercise powers or perform duties under the laws such as court, polices, Revenue Department, Department of Labour Skill Development, Welfare and Labour Protection Department, Department of Legal Execution, Stock Exchange etc.
6.3 Authorities, organizations, or the person relating to the exercise of right of claim, the commencing of legal proceeding, the objection to the complaint or the allegation, the defending of the case of the company such as the parties of the case and witnesses, etc.
6.4 Agents, contractors/sub-contractors and/or service providers for any operation provided for the company such as insurers, auditors and legal advisors, etc.
6.5 Persons Having Business Relationship (in case that it is necessary for the compliance with agreements in case that there is a joint operation of project or business)
6.6 Management system standards certification institutes
6.7 Training participants
6.8 Shareholders, debenture holders and the representatives of such persons
6.9 Banks or financial institutions
6.10 Other third parties such as the announcement of relevant persons who have been selected through social media channels of the company or the public relations of activity photos or news and information on the conducting of activities or projects of the company to the mass media and third parties, etc.
7. The submission or transfer of personal data to foreign countries
In some circumstance, we may be required to disclose your personal data to foreign countries, which may have standards of personal data protection different than those of Thailand because the company has companies in the group which are located offshore, there might be the disclosure of information to foreign countries. In this regard, for the submission or transfer of your data to foreign countries in whatsoever case, the company shall comply with the Personal Data Protection Act B.E 2562 (2019).
8. Your rights as the owner of personal data
As the owner of personal data, you have the rights as prescribed in the Personal Data Protection Act B.E 2562 (2019). In this respect, you can request to exercise your relevant rights through the channels specified by the company in Clause 9 or through the company website, In this respect, your relevant rights shall have details as follows:
8.1 Right to be Notified: The data subject shall be notified when personal data is necessary to be collected for use.
8.2 Right to Access: The data subject can request a copy of his/her personal data, as collected by the company in order to improve and update the information, and can ask for explanations in the case that his/her personal data has been disclosed without any prior consent (if any).
8.3 Right to Data Portability: The data subject has the right to ask the data controller to transmit his/her data to another data controller.
8.4 Right to Restrict Processing: The data subject has right to restrict the processing of his/her personal data to others.
8.5 Right to Withdraw Consent: The data subject can petition cancellation of the company access to his/her personal data.
8.6 Right to object: The data subject can object / or erase the company’s storage retention, use or disclosure of personal data in some certain cases as prescribed by law.
8.7 Right to Erase: The data subject has the right to request the company to delete, destroy or anonymize the personal data.
8.8 Right to notify the company to modify, change or delete his/her personal data.
8.8.1 The data subject has the duty to send accurate and up-to-date personal data to the company within the given time span.
8.8.2 The data subject must inform the company immediately if any of his/her personal data leads to harm or damage to the company.
All the rights stated herein will be granted to the data subject upon his/her written request or through electronic tool. The company will exercise in discrete evaluation of the calls and may reject in some certain instances, including, in the case that is determined by legal requirements, or in the case that the personal data is no longer specified with the data.
9. Security of your personal information
The Company attaches great importance to the security of your personal data. The Company will regularly monitor and implement appropriate corporate, physical and technical security measures. To store and process your personal data Please be assured that your personal information will not be lost. Accidentally destroyed, exposed, and misused or disclose to other persons who are not employees or processors of personal data performing the duties of the Company
HANA Microelectronics Public Co., Ltd (Bangkok)
65/98 Soi Viphavadi-Rangsit 64 Junction 2, Talad Bangkhen, Laksi, Bangkok 10210
Tel. 02-551-1297, 02-521-4935
Hana Microelectronics Public Co., Ltd (Lamphun)
101/2 Moo4, Northern Region Industrial Estate, T. Baan-Klang, A. Muang Lamphun 51000
or 123 Moo5, Sahaphat Industrial Estate,T.Phasak, A. Muang Lamphun 51000, Thailand
Tel. (053) 581-567-73, (053) 552-361
Hana Semiconductor (Ayutthaya) Co., Ltd
100 Moo1, KM.59 Asia Road,T. Bann-Len, A.Bang Pa-in, Ayutthaya 13160
Tel. (035) 350-803-4, (035) 729-297-301
10 Amendment of the Personal Data Protection Notice
This privacy notice it is part of the Company's privacy protection policy where the company will review the privacy policy on a regular basis and may affect the privacy notice of the owner of the personal information. You can see the latest changes from the date at the bottom of the Privacy Notice via the Company's website https://www.hanagroup.com
The Privacy Policy shall be effective from 17 May, 2022