Privacy Notice and Data Subject Rights

PROEN Corp Public Company Limited announced its Personal Data Protection Policy on November 1, 2022, in compliance with the Personal Data Protection Act B.E. 2562 (2019). Under Section 23, employees are required to provide a privacy notice to prospective and existing customers. The key details are as follows:

Data Controller Information

Contact Address: Head Office:PROEN Corp Public Company Limited             72 Telecom Tower, 4th & 18th Floor, Charoenkrung Road,             Bang Rak Subdistrict, Bang Rak District, Bangkok 10500 Huai Khwang Office:PROEN Corp Public Company Limited             11/80 Soi Pracha Uthit 8, Intersection 2, Pracha Uthit Road,             Huai Khwang Subdistrict, Huai Khwang District, Bangkok 10310

Data Protection Officer (DPO) Information             Name: Ms. Jiraporn Pimjumpa             Contact Address: PROEN Corp Public Company Limited             11/80 Soi Pracha Uthit 8, Intersection 2, Pracha Uthit Road,             Huai Khwang Subdistrict, Huai Khwang District, Bangkok 10310             Contact Channel: Privacy Center 0 2690 3888             Email: jiraporn.p@proen.co.th

 

Personal Data Processed

General Personal Data:

• Personal Identification Data: Full name, details from national ID card or passport, copies of ID card, or ID number.
• Contact Information: Address, phone number, Line ID, and other social media contact channels.
• Workplace Information: Job title, department, or organization.
• Electronic System Usage Information: Email, IP address, browser type, cookies, and chat history from various applications.
• Other Data: Information provided during interactions or participation in any company activities.

 

Personal Data Processing Period

No	Type of Personal Data	Processing Duration
1.	Identifiable information such as name, contact address, phone number, and email	1. If a person is a customer with issued quotations and transactions, the data is stored throughout the customer relationship and for 10 years after contract termination (as per the statute of limitations). 2. If there was prior communication but no agreement, consent is obtained for email retention until revoked (unless otherwise justified by legal grounds).
2.	Email, IP address, browser type, and cookies	90 days

 

 

Purpose of Collecting, Using, or Disclosing Personal Data

2.1 In general, whether you are a customer, a business partner, or an employee within the ProEN Corp Public Company Limited group, the company may process your personal data for the following purposes:

No	objective	Legal base
(1)	For coordination related to the Company’s business operations	Necessity for legitimate interests (Legitimate Interests)
(2)	For collecting and using your personal information, including name-surname, position, department, and photos-movies related to the operations and activities of the Company for public relations through various channels such as internal emails of PROEN Corp. and group companies, the Company’s website, Facebook, LINE, YouTube, Linked in TIKTOK, or other online media of the Company or other media such as television, print media, etc.	Necessity for legitimate interests (Legitimate Interests) Contractual Basis
(3)	To be used as information for applying for electronic access to the system or granting access rights or use of the Internet or various electronic systems.	Contractual Basis
(4)	To carry out business planning, reporting and forecasting, risk management, audit supervision, including internal auditing of the Internal Audit Office and internal management of the organization, including for use in internal operations of the Company related to disbursement of funds of the financial accounting unit.	(Legitimate Interests)   (Legal Obligation)
(5)	To be used as information for conducting Know Your Customer and/or Due process related to the Company’s operations, including due diligence, business or other forms of background checks for suitability assessment or risk consideration before deciding to enter into any transactions together, identity verification and confirmation and/or authorization verification, authorization and authorization to sign any agreement or contract with the Company.	(Legitimate Interests)
(6)	For the purpose of carrying out any transfer of rights, duties and benefits, such as a merger, separation or transfer of business, or which has been done in accordance with the law.	(Legitimate Interests)
(7)	To be a database of PROEN’s stakeholders and/or use information for relationship management or various coordination related to the Company, including opinion surveys, to analyze and improve the Company’s operations.	(Contractual Basis)   (Legitimate Interests)
(8)	To disclose information necessary for compliance with the various assessment criteria in which the Company participates.	(Legitimate Interests) (Contractual Basis)
(9)	For investigation, investigation of complaints within the organization, prevention of corruption or any other legal proceedings, including the examination and management of complaints and allegations related to the operations of the Company or related persons to create transparency and fairness for all parties.	(Legitimate Interests)
(10)	To recruit or consider for participation in the Company’s projects or activities, such as field trips, study tours, business visits, donations, seminars, training projects or other projects of the Company or that the Company operates in collaboration with external parties or government agencies, etc., including any actions related to participation in activities, such as answering questions to win prizes, delivering prizes, taking action to manage your health and safety, such as taking out health insurance for participation in field trips, etc., as well as evaluating, analyzing and improving the implementation of projects or activities.	(Contractual Basis)
(11)	For security purposes within the building, premises, the company includes exchanging cards before entering the area, recording images of people who come into contact with the company or the building, premises with CCTV.	(Legitimate Interests)
(12)	For the establishment of legal claims, the granting and receipt of authorization, the performance or exercise of legal claims, or the defense of legal claims, the taking of legal actions, and the enforcement of legal actions.	(Legitimate Interests)
(13)	To comply with laws regarding public health benefits, such as health protection from dangerous communicable diseases or epidemics that may be transmitted or spread into the Kingdom.	(Vital Interests) Section 26 (5) (b) Public Health Benefits
(14)	For your health and safety management	(Vital Interests)
(15)	When you access our social media such as Facebook, LINE, YouTube and other online media, the Company may collect, use or disclose your personal information for the following purposes: (a) To measure performance and analyze market surveys and marketing strategies, including to conduct business planning, reporting and forecasting. (b) To survey opinions, analyze, research and develop products and services, including the Company’s activities to suit your needs and to develop public relations communications to meet your needs. (c) For risk management, auditing, including internal auditing of the Internal Audit Office and internal management of the organization, such as to investigate and prevent corruption, etc. (d) For contacting for additional information, investigating complaints, managing complaints, recording the results of the operation, and implementing the Company’s internal processes. (e) For selecting people to participate in activities, answering questions via online channels, announcing the results of the activities, distributing prizes to participants in activities according to the conditions specified by the Company, including collecting a database of participants’ history with the Company. For compliance with the law, investigation, investigation according to legal processes and other regulations, and for reporting or disclosing information to government agencies or other organizations under the authority of the law or court orders, including for the establishment of legal claims, compliance with or exercising legal claims, or defending rights. Claim by law	(Legitimate Interests) (Consent) (Legal Obligation)

 

In addition to the above purposes, the Company may further process your personal data in the following cases:

2.2 In the event that you are a customer, the Company may further process your data for the following additional purposes:

No	objective	Legal base
(1)	For consideration of approval of requests to purchase products and/or use services, including identity verification processes, authorization verification, authorization and authorization, consideration of risks in entering into related transactions, and implementation of the Company’s internal processes for making contracts, performing contracts, delivering goods, providing services, including contacting, coordinating, collecting expenses, delivering related documents, etc.	(Contractual Basis)   (Legitimate Interests)
(2)	For the purpose of evaluating, improving and developing the Company’s products, services and various sales promotions, including surveying satisfaction regarding the Company’s products and services to ensure they are appropriate and meet your needs.	(Legitimate Interests)
(3)	To be used as information and supporting documents for any operations with banks, financial institutions, the Department of Business Development, the Revenue Department, the Excise Department, the Stock Exchange of Thailand, the Securities and Exchange Commission, and other relevant external agencies.	(Contractual Basis)     (Legal Obligation)

 

The personal data that the Company collects for the above purposes is necessary for the performance of the contract or compliance with applicable laws. If you do not provide such necessary personal data, it may be a violation of the law or the Company may not be able to manage or administer the contract or facilitate the implementation of various procedures for you.

If there is a change in the purpose of collecting personal data later, the Company will notify you and take other actions as required by law, including keeping a record of any amendments as evidence.

Sources of personal data

1. We receive personal data directly from you.
2. We receive your personal data from third parties that we honestly believe have performed the duties of a data controller and disclosed information obtained legally.

Processing personal data

Once we receive personal data from the source of the personal data, we will do the following with your personal data:

Collect contact information to offer products and services on Google sheet, SAP, Proen cloud, PIC, each party’s files (documents) and necessary information for making a sales contract or using services on the company’s database on Google cloud.
Use such information to contact you to offer products or services that you may be interested in.
Disclose relevant information as a data processor, including Salesforce, Google cloud, Flow account, subcontractors in activities under contract, data processing with the Company, individuals, government agencies that are required by law to disclose, such as the Revenue Department, auditors, Social Security Office, etc. In addition, we may need to send your personal information to credit bureaus for verification and may use the results of such data verification for fraud prevention.

We may need to transfer your personal data to foreign entities or international organizations.

Data processors located overseas include Microsoft 365 and Google.

Data processors used by our processors include AWS.

Such entities have appropriate safeguards in place, such as:

Salesforce	https://www.salesforce.com/th/company/privacy/ https://www.salesforce.com/th/company/privacy/apec-prp-notice/
Google	https://policies.google.com/privacy?hl=th https://policies.google.com/privacy/frameworks?hl=th
AWS	https://aws.amazon.com/th/compliance/thailand-data-privacy/

 

Retention of Personal Data

The controller will retain your personal data as follows:

1. Type of storage: Digital file and document

2. Storage location: Stored on proen Cloud, PIC, used with Google, Microsoft 365, ***Purchasing

Regarding SAP

3. The storage period is in accordance with the topic Period of processing personal data
4. When the storage period has expired or we no longer have the right or cannot claim the basis for processing your personal data, we will destroy the personal data by deleting and destroying it and will complete the process within 60 days from the end of the said period.

 

Rights of Data Subjects

You have the following rights:

(1) Right to withdraw consent: You have the right to withdraw your consent to the processing of your personal data that you have given us, for the duration of the time that your personal data is with us.

(2) Right to access your personal data: You have the right to access your personal data and request that we make a copy of it, including requesting that we disclose the source of your personal data that you have not given us consent to.

(3) Right to rectification: You have the right to request that we correct inaccurate or incomplete data.

(4) Right to erasure: You have the right to request that we erase your data for certain reasons.

(5) Right to restriction of processing: You have the right to restrict the processing of your personal data for certain reasons.

(6) Right to data portability: You have the right to transfer your personal data that you have provided to us to a controller. Other information or yourself for certain reasons.

(7) Right to object to the processing of personal data (right to object): You have the right to object to the processing of your personal data for certain reasons.

You can contact our staff through the above contact channels to file a request to exercise the above rights.

You do not need to pay any expenses for exercising the above rights. We will consider and notify you of the results of your request within 30 days from the date we receive the request. In the event that we or our employees or staff violate or fail to comply with the law on personal data protection, you can file a complaint with

 

Office of the Permanent Secretary, Ministry of Digital Economy and Society

Acting as the Office of the Personal Data Protection Committee

120 Moo 3, 6th-9th Floor, State Administration Building

Government Complex Commemorating His Majesty the King’s 80th Birthday Anniversary, 5 December 2007

Chaeng Watthana Road, Thung Song Hong Subdistrict, Lak Si District, Bangkok 10210

 

Announced on 10 February 2025