Privacy Notice for Job Applicants and Employees
§ 01About this notice
Ruk-Com Co., Ltd. and the external providers engaged under our data processing agreements (together, “we”) recognise your privacy rights and our responsibilities in collecting, using and disclosing (“processing”) your personal data as a job applicant or employee of the company. We therefore publish this privacy notice to explain how your personal data is processed under the Personal Data Protection Act B.E. 2562.
§ 02Definitions
- “Personal data” means information about a person that can identify them directly or indirectly, excluding data about deceased persons.
- “Sensitive personal data” means the data defined in section 26 of the PDPA — for example racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data with a similar impact on the data subject.
- “PDPA” means the Personal Data Protection Act B.E. 2562, together with related subordinate legislation and amendments from time to time.
- “The Committee” means the Personal Data Protection Committee.
§ 03Personal data we collect
The personal data we may collect includes:
- Identifying data such as name and surname, nickname, date of birth, age, province of birth, national ID number, copy of the house registration, copy of the ID card, bank account number, copy of the driving licence, address, weight, height, photograph and military service certificate.
- Contact details such as phone number and email.
- Family and reference information such as marital status, spouse’s name, parents’ details, number of children, emergency contact and referees.
- Education history and employment history.
- Use of IT systems and internal access logs, as well as CCTV footage within company premises, for security purposes.
The company may also process sensitive personal data about you, such as criminal records, for pre-contract checks (for example anti-money-laundering screening) that are necessary before entering into a contract. If you do not provide this information, the company may not be able to consider entering into a contract with you.
If you provide us with another person’s personal data, you confirm that you have shown them this notice and obtained their consent to disclose their data to us.
§ 04How we collect your data
We generally collect personal data directly from you, except in some cases where we may collect it from the person who referred you, from public sources, business sources or commercial sources.
§ 05Purposes and legal bases for processing
| No. | Purpose | Legal basis |
|---|---|---|
| 1 | To enter into a contract with you and perform the rights and duties under it | Consent / contract |
| 2 | To verify and confirm your identity and to check your background and qualifications before employment | Consent |
| 3 | For internal management of the hiring process — for example sending applicant details and interview reports to decision-makers, preparing employment contracts, training and onboarding new employees | Legitimate interest / contract |
| 4 | To consider you for other suitable positions in future | Legitimate interest |
| 5 | To maintain security within the company’s buildings or premises | Legitimate interest |
| 6 | To manage access rights to IT systems and maintain the security of the company’s systems and infrastructure | Legitimate interest |
| 7 | In some cases the company may use digital tools or artificial intelligence (AI) to help with initial application screening, with a member of staff always making the final decision | Legitimate interest / consent |
§ 06Who may receive your personal data
We may disclose and/or transfer your personal data to the following parties, who may be located inside or outside Thailand:
- Data processors engaged under the company’s data processing agreements.
- Internal and external advisers or experts, such as legal counsel, auditors and HR system providers (including cloud-based systems).
- Law enforcement agencies, state agencies, regulators or dispute resolution bodies, as required by law or under relevant agreements.
- Parties entering or proposing to enter into a transaction with the company, such as a sale or proposed sale of the business (if any).
- Any other party to whom you have given explicit consent.
§ 07Cross-border transfers of personal data
Your personal data may be stored or processed by the company or by the providers described above, which may be located or operating in Thailand or abroad (for example cloud-based HR systems). Cross-border transfers follow the data protection conditions required by the PDPA.
§ 08Retention of personal data
We keep your personal data for as long as necessary to achieve the purposes above, and for no more than 10 years from the date your relationship or last contact with us ends, unless the law permits longer retention. At the end of that period we delete, destroy or anonymise the data.
§ 09Your rights regarding personal data
You have the following rights in relation to your personal data:
- Withdraw or request changes to the scope of the consent you gave us.
- Ask whether we hold your personal data, request access or a copy, and ask how we process it.
- Request correction of your personal data.
- Request deletion or destruction of your personal data in certain cases.
- Request restriction of the processing of your personal data in certain cases.
- Request the transfer of your personal data in certain cases.
- Request temporary suspension of the processing of your personal data in certain cases.
We act on requests within 30 days of receiving the request with complete documents. We reserve the right not to comply to the extent the law permits, and may charge a reasonable fee. You also have the right to complain to the expert committee under the procedure in the PDPA.
§ 10Changes to this notice
The company reserves the right to amend, add to, change or improve this notice to the extent the law permits. Where a change is material, the company notifies you and/or requests your consent where the law requires it.
§ 11Contact channels
If you have questions about this notice, or want to exercise your rights over your personal data, please contact us at: