This Personal Data Protection Notice (referred to as "Notice") is issued by Tidlor Public Company Limited (referred to as "the Company")

1. Application of the Notice

   This Notice applies to anyone the Company contacts and who owns personal data that the Company obtains regarding employment / working relationships with the Company, whether (1) job applicants, (2) employees / staff / workers including consultants, (3) former employees, and (4) other individuals (e.g., references, emergency contacts, related persons, etc.) from whom the Company has obtained personal data (all referred to as "you")

2. Changes to the Notice

   The Company may amend or update this Notice from time to time to keep it current. In the event that the Company changes its practices or policies regarding the collection, use, and/or disclosure and/or transfer of personal data, or applicable laws change, the Company will notify you clearly. Please read this Notice carefully and check the information on https://www.tidlor.com/en/policy/privacy/employee for the current version of the Notice with changes

3. How the Company Collects, Uses, Discloses, and/or Transfers Your Personal Data and Protects Your Personal Data

   This Notice explains how the Company collects, uses, discloses, and/or transfers your personal data, so that you are aware of your rights as a data subject, and can contact the Company when you have other questions

1. Types of Personal Data the Company Collects

   As part of employment or service provision between you and the Company, the Company may collect or obtain various types of your data during job interviews, from the start of employment contracts and during work or service provision, directly or indirectly from other sources (such as public sources) and/or through affiliated companies (such as references from other entities in the Krungsri Group and Tokyo-Mitsubishi UFJ Bank (MUFG Bank, Ltd.) and companies in the MUFG Group), service providers, business partners, or third parties (such as hospitals, recruitment agencies, and staffing providers). The nature of collection depends on your relationship with the Company, as follows

   1. Personal Data

      Under this Privacy Policy, "Personal Data" means any data relating to a person or that enables identification of that person, as follows

      Type of Personal Data	Details and Examples
      Name, Initials, and Identity Characteristics	Data that identifies you, used to call you, or refer to you, such as title, first name / initials from first name, middle name / initials from middle name, surname, maiden name, alias or name previously used, and signature, age, date of birth, gender, height, weight, marital status, nationality, military service information, hobbies and interests, photographs, language abilities, and number of children
      Government-Issued Identification Data	Numbers or codes issued by responsible agencies for you to verify your identity, such as national ID number, other ID numbers issued by government agencies, driver's license number, business license number, work permit number, identity verification for health plans or government-supported food allocation plans, passport number, and alien registration number
      Contact Information	Your contact details, such as home address, address for document delivery, home phone number, home fax number, personal email, personal mobile phone or wireless network, social media history or username (Handle), work address, work phone number, work fax number, work email, work mobile phone or wireless network
      Education and Employment Information	Your education and work information, such as educational qualifications and enrollment, licenses, professional organization membership status, and academic results, occupation / rank, position, department, employer registration number, job code, organization credit or debit card number, details about work visa status / employment approval, drug test results, reference and background information, tax ID number, workers' compensation insurance claims, employment records (and salary information, attendance, and various benefits), start date, termination date, employee-owned assets, and various assessments (performance evaluations and various possibilities), including use of various technologies - assessment of technology use (such as internet and email, etc.)
      Financial Information	Your financial information, status, and history, such as background checks, account numbers with financial institutions, financial transaction history, loan history, banking information, deposits for investment, workers' compensation insurance claim history, source of income, salary, service fees, other compensation, and salary deductions as required by law and voluntary deductions by employees for financial assistance (such as benefits, employee loan welfare benefits, assistance, grants, and subsidies)
      Demographic Segmentation	Segmentation based on personal characteristics, such as household age indicators, assigned market area codes, number of household members, number of vehicles owned, higher education, and type of residence
      Communication Device Information	Information about devices and device usage, including technical device information, such as location coordinates, telecommunications tower data, audio / video / photo / camera access data, calendar data, call logs, contact list / address book for messaging or email (message or email content), Unique Device Identifier (UDID), computer serial number, click behavior / online website tracking data, unstructured data (text, audio, images, video, etc.), RFID data, login verification data, security codes, access codes, or any necessary passwords, username, account login password, telemetry license number or metadata, end-user activity data, such as website visits (even if the Company does not know the user's identity), and files created by websites you visit (cookies) or similar technologies
      Views and Opinions	Information about your views and opinions, such as your needs regarding employment contracts / working relationships, or other information you choose to provide to the Company, opinions, feedback, complaints, suggestions, survey responses, questions and information you voluntarily provide during discussions about human resources

      If you do not provide your personal data to the Company, the Company may not be able to offer you positions as requested, and may not be able to perform all duties the Company has towards you under the employment contract / working relationship with you, or may not be able to fulfill obligations the Company must perform under the law

   2. Sensitive Personal Data

      The Company may collect, use, or disclose your sensitive personal data only when it has received your explicit consent through appropriate means, to perform employment contracts, establish legal claims, defend, comply with or exercise legal claims, perform important public interest duties under the law, or other matters as required by law

      Type of Sensitive Personal Data	Purpose
      Criminal History Data	To collect and use your legal violation history for background check purposes, qualification verification, suitability assessment before joining the Company. However, if you do not provide consent or withdraw consent for this type of personal data, it may result in the Company being unable to assess your suitability for employment
      Health Information	The Company may collect and use your health information for employment consideration, contract performance, management of leave history, salary, and various benefits (such as workers' compensation insurance claims). Your health information that the Company collects may include blood type, medical record number, health plan beneficiary number, communication device identification and medical treatment sequence number, disease diagnosis, medical treatment history, medical payment information, medical compensation claim usage information, medical photographs, and metadata, Rx number / prescription, health insurance ID or account number, medications, treatments, or medical products or devices used, physical health, mental health, test results or genetic information, family health history or illness history, and annual physical examination results
      Ethnicity Information	The Company may collect ethnicity information about you for use in contracts
      Religion Information	The Company may collect religion information about you for use in contracts, managing evidence and leave records
      Biometric Data	The Company may collect and use physical data (such as fingerprints and facial recognition) to verify identity and access buildings

      However, in cases where the Company collects, uses, or discloses your sensitive personal data under the consent basis, your failure to provide consent or withdrawal of such consent may result in the Company being unable to assess your suitability for employment, perform duties under employment contracts, or provide necessary facilitation or management that requires related data

   3. Third-Party Data

      The Company may collect third-party data for use in references, certifications, any actions related to employment, and contacts. If you provide third-party personal data to the Company, such as your mother's maiden name, spouse information, family member information, children's information, company director / shareholder / representative / managing director information, guarantor information, beneficiary information, or if you request the Company to disclose personal data of such persons to third parties, you must inform such persons of the details according to this Notice, and obtain permission and consent from such third parties (in cases where consent is required). In addition, you must ensure that the Company can collect, use, or disclose personal data of such persons legally as stated in this Notice

   4. Personal Data of Minors, Incompetent Persons, and Quasi-Incompetent Persons

      The Company may collect, use, or disclose data of minors, incompetent persons, and quasi-incompetent persons for consideration of suitable work. In cases where consent must be obtained from such persons, the Company will only obtain consent from guardians with authority to act on behalf of minors, guardians, or curators, respectively, unless the Company can cite other legal grounds

      However, if the Company later learns that it has collected personal data of persons under 20 years of age without consent from guardians with authority to act on behalf of minors, or cases of incompetent persons or quasi-incompetent persons without consent from guardians or curators, respectively, without the Company knowing such facts, the Company will immediately delete such data, or will only collect, use, disclose, and/or transfer such data when the Company can cite other legal grounds besides consent

2. Purposes for Collecting, Using, or Disclosing Your Personal Data and Legal Bases

   The Company may collect, use, or disclose your personal data depending on your relationship with the Company, benefits you receive from the Company, as well as the relationship between the Company and you and the Company's business partners, and/or other considerations as follows

   1. Purposes for Collecting Your Personal Data

      The following purposes are only guidelines for how the Company will use data, and the Company will only use your data in ways relevant to you

      Purpose	Details
      Pre-Employment Process	For recruiting suitable personnel (such as employment decisions, or reference checks if previously employed, and employment transfers between Tidlor Public Company Limited and group companies), to process job applications, interviews, qualification assessments according to application details, your suitability, qualifications, and work performance, to conduct background checks and screening when you receive an offer to work with the Company, to verify work permits, to verify your information against prohibited persons lists, to approve job applications, and to contact you about positions you request or apply for (such as notifying you that your application passed or did not pass), and to assess base salary / expected salary
      Identity Verification	To verify identity when you apply to work with the Company / establish working relationships with the Company, or when the Company provides benefits to you, and to verify access and login rights, and to verify your address location so you can access your account
      Employment and Onboarding Process	To conduct onboarding processes, signing employment contracts, setting employment details, training, and employment certification, contacting you and emergency contacts, requesting work permits, allocating leave according to Company regulations, organizing organizational development activities, providing cards and information for various access, providing references and certifications, to evaluate you with performance evaluation reports, managing probation programs, promotions, work capabilities and succession, and gathering evidence if allegations arise about you, etc.
      Salary, Compensation, and Benefits	Managing salary payments, preparing net salary figures after various deductions, issuing certificates, issuing payment confirmation documents, provident funds, compensation, rewards, and various bonuses, for tax deductions and contributions both as required by law and voluntarily, to register / cancel membership in social security funds, for life and health insurance, and claim benefits, to allow employees to request and receive various benefits such as loans, travel expenses, accommodation, annual health checkups, and scholarships, and to verify financial transactions of agencies related to loan approval, and others
      Various Processes Related to Transactions and/or Payments	Money transfers, payments, transactions, and following orders, to consider loans and lending, disbursements, collateral registration, debt payments, debt settlements, repayments and closing loan balances offered to you to track debts and contract enforcement services, and managing your account appropriately with the amount you borrow
      Advertising and Marketing, and News Communication, Public Relations, and Information About Products and Services	To publicize and inform you of the latest information, communications, announcements, advertising, special privileges, special offers, and other information about products and services of the Company and/or other entities in the Krungsri Group
      Internal Organization Management and Relationship Maintenance	To analyze data, reports, and activities, maintain data in other ways, provide facilitation, procure tools and equipment, to track complaints, claims, and surveys, to manage employee contacts, to maintain and update various related information and records to be current, to maintain data to be accurate and complete, and to provide technology systems that can add value to information and various support, such as to provide access to information technology tools, systems, and various applications of the Company
      Various Post-Employment Processes	To process resignations, to provide post-termination services, issuing certificates, termination / employment termination, exit interviews, and ad-hoc surveys, and transfers to new positions in companies in the same group as the Company
      Protection of Company Interests	To ensure the Company's business operations are stable and complete, to exercise rights or protect Company interests when necessary and legally possible, for example, investigating, preventing, responding to fraud-related claims, assessing and identifying fraud risks, and detecting fraudulent transactions, claims regarding infringement of personal work rights, or legal violations, to manage and prevent loss of Company assets and property, checking designated persons lists, risk management, internal audits and records, asset management, systems and other business controls, to prevent or suppress dangers to life, body, or health of persons, to comply with Company agreements and conditions, to follow up when incidents occur, to prevent and report when criminal acts occur, to maintain the Company's business to be stable, secure, and complete, for reference and use as evidence regarding claims or legal proceedings
      Legal Compliance and Regulatory	To fulfill legal obligations, legal processes, or government orders, orders from government officials outside Thailand, and/or cooperation with courts, regulatory agencies, government officials, and legal agencies, when the Company has legal grounds to comply, and when the Company needs to disclose your data to comply with laws, legal processes, government orders, appropriate conduct principles, and internal policies of the Company and affiliated companies, to exercise Company rights or use as defense when legal claims arise, to maintain various records and resolve complaints and disputes, and to prepare activity reports, regulatory reports, and tax payments as required
      Security Monitoring and System Maintenance	To verify identity, control access and related records, to monitor systems, tools, and internet, review to ensure information technology systems are secure, to prevent and solve crimes, risk management and fraud prevention
      Corporate Transactions	When there are sales, transfers, mergers, restructuring, or similar actions, the Company will need to disclose and transfer your personal data to third parties, one or more persons according to the terms of such transactions

   2. Principles the Company May Reference and Other Legal Principles for Processing Your Personal Data

      The Company uses the following principles to collect, use, or disclose your personal data as appropriate, including

      Basic Legal Principle	Details
      Contract Principle	To enable the Company to do what is necessary to achieve contract purposes with you, and/or to provide benefits to you under the contract
      Legal Obligation	To enable the Company to fulfill its legal obligations (such as requesting identity verification documents as required by law)
      Legitimate Interest	Actions for legitimate interests of the Company and third parties (such as investigating and preventing fraud)
      Vital Interest	To prevent or suppress dangers to life, body, or health of persons
      Your Consent	To collect, use, or disclose your personal data when consent is obtained

3. Who Does the Company Disclose or Transfer Your Personal Data To

   The Company may disclose your personal data to third parties who collect, use, disclose according to the purposes stated in Section 2 above to persons in the table below depending on your relationship with the Company and services you receive from the Company. You can view the privacy policies of such third parties to learn more about how they collect, use, and disclose your personal data

   Type of Data Recipient	Details
   Affiliated Companies	The Company may need to disclose your personal data to other companies in the Krungsri Group, including financial business group companies and Company affiliates, including Tokyo-Mitsubishi UFJ Bank (MUFG Bank, Ltd.) and companies in the MUFG Group located in Thailand and other countries, including Japan and countries beyond
   Service Providers	The Company may hire other companies to provide services and assist the Company in employment contracts / working relationships of the Company. The Company may disclose your personal data to these service providers, or service providers may collect your personal data on behalf of the Company themselves, for business use, including human resources services, such as the Company hiring and assigning some business work to third parties providing infrastructure, software, and website development services, information technology service providers, data storage and cloud service providers, recruitment companies, and human resources service providers that do not use internal Company personnel, survey service providers, card production service providers, payroll service providers, social media service provider companies, document printing service providers, work permit application service agents, travel agents, and training service providers, payment service providers, payment network service providers, research agents, marketing agents, email service providers, SMS service providers, data analytics service providers, administrative and business support service providers, document destruction service providers, delivery service providers, data import service providers, and tax, visa, and work permit service providers, etc.
   Company Partners	The Company may disclose your personal data to partner companies to offer human resources services to you or enhance such services (such as hospitals, insurance companies, and brokers)
   Professional Advisors	The Company may disclose your personal data to professional advisors providing audit, legal, accounting, and tax services to assist with the Company's business operations and help the Company defend or pursue legal cases, initiate and auction foreclosures, or perform other legal duties
   Third Parties You Authorize or Designate for the Company to Disclose Your Personal Data	The Company may disclose your personal data when authorized by you or as you have requested
   Third Parties Who Are Assignees, Asset Assignees, or Assignees Under Debt Restructuring Agreements	The Company may assign rights, assign assets, or enter into debt restructuring agreements to assign rights and duties of the Company to third parties, within the scope of contracts between you and the Company. The Company may disclose or transfer your personal data to assignees, asset assignees, or assignees under debt restructuring agreements, including future assignees, asset assignees, or parties to future debt restructuring agreements
   Third Parties Related to Corporate Transactions	The Company may need to disclose or transfer your personal data to business partners, investors, major shareholders, assignees, future assignees, asset assignees, or future asset assignees, if there is organizational restructuring, or debt restructuring, business mergers, acquisitions, disposals, purchases, joint ventures, rights transfers, business dissolution, or other similar events involving transfer or disposal of some or all of the Company's business, assets, or shares
   Government Agencies and Other Agencies the Company Must Disclose Personal Data to for Legal Use or Necessary Reasons	The Company may disclose your personal data to government agencies and regulatory agencies (such as Bank of Thailand, Government Housing Bank, Department of Lands, Ministry of Labor, Royal Thai Police, Revenue Department, Immigration Bureau, Social Security Office, Student Loan Fund, Legal Execution Department, and courts) and other agencies for legal use, regulatory purposes, and when necessary, and may need to disclose personal data if regulatory agencies or government agencies request as required by law, legal order compliance, inspections, or legal processes / claims
   Other Types of Data Recipients	Companies, financial institutions, or educational institutions that are not Company partners that may request your personal data for reference when you apply for products, services, educational programs, or other purposes used for reference

4. Transfer of Your Personal Data Abroad (if any)

   The Company may need to transfer your personal data to third parties or parties located abroad to fulfill the Company's business purposes or for your benefit, for online training where service providers are located abroad, including to comply with any other purposes stated in this Privacy Policy. In cases where the destination country has personal data protection standards that are not equivalent to Thailand, to ensure that your personal data is collected securely and in accordance with relevant data protection laws, the Company will implement necessary and appropriate personal data protection measures to ensure that the transmission or transfer of personal data complies with the Personal Data Protection Act, which in some cases may include entering into relevant standard contracts or using other equivalent measures with third parties or parties located outside Thailand

5. Retention Period for Your Personal Data

   The Company will retain your personal data for as long as necessary to use according to the purposes explained in this Notice and as required by applicable laws. For criminal history data, the Company will retain it only for the period specified by relevant laws. For other personal data, the Company will retain it for 10 years from the date of employment contract termination. However, the Company may retain your personal data longer than the period stated above to comply with applicable laws and regulations, including Company internal policies, or to comply with Company requirements, for managing relationships with employees and staff, and/or to comply with legal claims when relevant government agencies, including regulatory agencies, request

6. Your Rights

   Under the provisions of the Personal Data Protection Act and exceptions under relevant laws, you may have the following rights

   • Right of Access You have the right to view data that has been collected, used, disclosed, and/or transferred regarding your personal data, or request copies of your personal data, or request to know the source of personal data that you did not authorize
   • Right to Request Correction of Your Personal Data If you believe that your personal data is incorrect, not current, or incomplete, you may request correction of such personal data
   • Right to Deletion or Destruction You have the right to request deletion, destruction, or anonymization of your data that the Company has collected, used, or disclosed so that it cannot identify the data subject, but must comply with the law
   • Right to Suspend Use You may have the right to request suspension of use of your personal data in some cases
   • Right to Object You have the right to object to the collection, use, disclosure, and/or transfer of your personal data, such as objecting to direct marketing
   • Right to Withdraw Consent If you have consented to the collection, use, disclosure, and/or transfer of your personal data, you have the right to cancel consent at any time
   • Right to Request Personal Data If the law grants such right, you have the right to request your personal data from the Company in a readable electronic format, and to transmit or transfer such data to other data controllers, provided that (a) it is personal data that you have provided to the Company, and (b) the Company obtained your consent or to perform a contract with you
   • Right to Complain You have the right to complain to agencies responsible for the collection, use, disclosure, and/or transfer of your personal data, whether the Company is the operator or another person operates on behalf of the Company. However, the Company requests an opportunity to address your concerns before you contact the authorities. The Company requests that you contact the Company first to discuss and resolve your concerns

   However, exercising your rights as specified may be subject to legal limitations, and in some cases the Company can deny your request with reasonable grounds. You can exercise the above rights as stated in the "Contact the Company" section

7. Contact the Company

   The Company values protecting personal data of employees, staff, including applicants, and is committed to complying with the Personal Data Protection Act B.E. 2562. You can contact the Data Protection Officer to complain about personal data management at email [email protected], or if you have questions about such matters, please contact: