CCTV Privacy Notice
Last updated: June 2, 2026
Rakcom Company Limited (referred to as “the Company” or “we”) operates closed-circuit television (CCTV) cameras for surveillance within the Company’s office area (“the Area”) to protect lives, health, and property. We collect personal information of staff, operators, customers, employees, contractors, visitors, or any other individuals (hereinafter collectively referred to as “you”) who enter the Company’s office area through the use of the CCTV equipment.
Scope of this announcement: This announcement applies only to CCTV cameras installed and controlled by the company within its offices. CCTV cameras in common areas of buildings and within data centers are installed and controlled by the building owner or data center service provider, who controls the personal data in those areas and is subject to their respective privacy policies. The company is not involved in and is not responsible for the processing of data from CCTV cameras that are outside the company’s control.
This Privacy Notice for the Use of CCTV Cameras (“Notice”) provides information regarding the collection, use, or disclosure of information that can identify you (“Personal Data”), as well as your rights, as follows:
1. Legal basis for processing personal data.
We collect your personal data under the following legal basis:
- A legitimate interest refers to our legitimate interest, or the interest of others, in ensuring the safety of individuals and property. This interest is no less important than your fundamental right to privacy and personal data.
- Legal obligations include complying with relevant laws, such as collecting data as required by law.
- The basis of vital interest is to prevent or mitigate harm to a person’s life, body, or health.
2. Purpose of collecting your personal data.
We collect your personal data for the following purposes:
- 2.1 To protect your personal health and safety, including your property.
- 2.2 To protect our offices, facilities, and property from damage, obstruction, destruction of property, or other crime.
- 2.3 To support relevant law enforcement agencies in deterring, preventing, investigating, and prosecuting legal cases.
- 2.4 To provide assistance in the dispute resolution process that arises during disciplinary or grievance proceedings.
- 2.5 To provide assistance in the investigation process or the process related to submitting a complaint.
- 2.6 To provide assistance in initiating or preventing civil litigation, including but not limited to legal proceedings related to employment.
3. Personal information that we collect and use.
In accordance with the objectives stated in point 2, we have installed CCTV cameras in visible locations. Warning signs indicating the use of CCTV cameras will be placed at entrances and exits, as well as in areas deemed necessary for monitoring, in order to collect your personal information when you enter the area, as follows:
| List of personal data collected. |
|---|
| slide |
| Animated images |
| Audio (only for cameras that record audio) |
| Photographs of your belongings, such as vehicles, bags, hats, clothing, etc. |
We will not install CCTV cameras in areas that may unduly infringe upon your fundamental rights, including restrooms, bathrooms, showers, prayer rooms, or areas used for rest by our staff.
4. Disclosure of your personal information.
We will keep all CCTV footage relating to you confidential and will not disclose it except where necessary to achieve the surveillance objectives specified in this notice. In such cases, we may disclose CCTV footage to the following types of individuals or entities:
- 4.1 Agencies with the authority and responsibility as prescribed by law to assist and support the enforcement of laws, or to conduct investigations, inquiries, or various legal proceedings.
- 4.2 Third-party service providers, necessary to ensure the prevention or mitigation of harm to your life, body, health, and property, or that of others.
- 4.3 Image storage service providers or cloud services, as personal data processors, shall comply with the Personal Data Processing Agreement (DPA) and appropriate protection measures.
5. Using CCTV footage for system development and testing.
In addition to the security purposes as outlined in Clause 2, the Company may use images or data from CCTV cameras for the development, testing, and improvement of the Company’s systems and services (e.g., CCTV management and display systems, image analysis systems, or related features). This is considered a separate and specific purpose from security surveillance and is carried out under the following protection measures:
- Use only necessary data (Data Minimization) and prioritize the use of data that prevents personal identification (Anonymization) or masking (Face/Identity concealment) whenever possible.
- Access is restricted to essential personnel, operating in a separate environment from the actual service system (segregation), with access and usage logging implemented.
- The data will not be used for automated decision-making that has a significant impact on individuals without individual oversight, and will not be used for marketing or disclosed to third parties for commercial purposes.
- Where it is necessary to process personally identifiable images or biometric data (such as facial recognition, which is sensitive personal data under Section 26), the company will conduct a Data Protection Impact Assessment (DPIA) and establish the appropriate legal basis, including obtaining explicit consent where required by law, before processing.
- Upon completion of the development and testing objectives, the company will delete or destroy such data, or anonymize it.
6. Transferring personal data to other countries.
In cases where CCTV footage is stored or processed on a cloud system or data center located overseas, the company will implement appropriate data protection measures in accordance with Section 28 of the Personal Data Protection Act B.E. 2562 (2019), such as the use of Standard Contractual Clauses (SCCs) or other mechanisms recognized by law, consistent with the best practices for cloud-based data protection according to ISO/IEC 27017 and ISO/IEC 27018.
7. Duration of personal data retention.
To achieve the objectives of surveillance using CCTV equipment as stipulated in this announcement, we will retain personal data from CCTV cameras related to you for a period of 30 days from the date of recording. After this period, we will delete or destroy your personal data, unless it is necessary to retain it longer for investigation, legal proceedings, or as required by law.
8. Maintaining the security of personal data.
We have appropriate technical and administrative security measures in place to protect your personal data and prevent data loss, unauthorized access, deletion, destruction, use, alteration, modification, or disclosure. These measures are consistent with our Information Security Policy and practices, based on ISO/IEC 27001 (Information Security Management System) and ISO/IEC 27701 (Personal Data Management System), as well as cloud practices according to ISO/IEC 27017/27018. Examples include access control and restriction, authentication, data encryption as appropriate, access logging and monitoring, and periodic reviews of these measures.
Furthermore, we have established a personal data protection policy, which is publicly available throughout the organization. This policy includes guidelines to ensure the security of the collection, use, and disclosure of personal data, maintaining the confidentiality, integrity, and availability of such data.
9. Your rights under the Personal Data Protection Act B.E. 2562 (2019).
The Personal Data Protection Act B.E. 2562 (2019) aims to give you greater control over your personal data. You can exercise your legal rights as follows:
- You have the right to access, receive a copy of, and request disclosure of the source of your personal data that we collect, except where we have the right to refuse your request by law or court order, or where your request would have a possible impact or cause harm to the rights and freedoms of other individuals.
- Your right to request correction of inaccurate or incomplete personal information to ensure it is accurate, up-to-date, complete, and does not cause misunderstanding.
- Your right to request the suspension of the use of your personal data in any case as prescribed by law.
- Your right to object to the collection, use, or disclosure of your personal data, except in cases where we have lawful grounds to refuse the request.
- Your right to request the deletion, destruction , or anonymization of your personal data in any case as required by law.
- The right to file a complaint with the relevant legal authority if you believe that the collection, use, or disclosure of your personal data is in violation of or does not comply with the law.
10. Responsibilities of the data controller.
We have designated only authorized personnel with the relevant duties and responsibilities for the collection, use, or disclosure of individuals’ personal data in the context of this processing activity. We will ensure that these personnel strictly comply with this notice.
11. Amendments to the Privacy Statement.
In order to update or change this notice, we may consider revising or changing it as we see fit and will notify you through our website, with the date of the latest version indicated at the end. However, we recommend that you check regularly for new notices, especially before entering our premises.
Your entry into this area constitutes acknowledgment of the terms and conditions of this notice. If you do not agree with the terms and conditions of this notice, and continue to enter the area after this notice has been amended and posted through the aforementioned channels, it will be considered that you have acknowledged the changes.
12. Contacting and inquiring.
You can contact us regarding this announcement at:
| Data Protection Officer (DPO) | Rakcom Company Limited |
| address | Vanich Place Ari (Building A), Unit 2703, 27th Floor, 304 Phahonyothin Road, Samsen Nai Subdistrict, Phaya Thai District, Bangkok 10400, Thailand. |
| [email protected] | |
| Opening hours | Monday to Friday, 9:00 AM to 6:00 PM (except public holidays) |
