Privacy Policy

Definition

Company means Eastern Water Resources Development and Management Public Company Limited.

Subsidiaries are companies with any of the following characteristics:

  • (1) a company that the Company has controlling authority
  • (2) a company under the controlling authority of the company according to (1) in descending order starting from being under the control of the company according to (1).

Group means Eastern Water Resources Development and Management Public Company Limited and subsidiaries.

Entity means a department, office or divisions that store personal data of the company and/or its subsidiaries according to the organizational structure of the company and/or subsidiaries.

Personal data means name, age, address, telephone number, National ID number, ethnicity, financial information, health information and other information which can directly or indirectly identify the identity of the owner, including information of partners, customers and information obtained from devices entering the Company's and/or subsidiaries' networks (Log data and device information).

Sensitive information means personal data regarding race, ethnic group, political opinion, belief in cult, religion or philosophy, sexual behavior, criminal record, health information, disability, trade union information, genetic information, biological information or any other information which affects the owner of the personal data similarly as stipulated by law.

Purposes of personal data collection: The Company and/or its subsidiaries will collect personal data of the owner for the benefit of operating according to the objectives of the company and/or its subsidiaries and/or for the benefit of any relevant operation and/or to support and/or promote the operation according to the objectives of the company and/or its subsidiaries. The Company and/or its Subsidiaries must always clearly notify the information owner about the purpose of the collection before or during the collection.

Guidelines for collecting personal data

1. The Company and/or its subsidiaries do not collect personal data, if the information owner did not give consent prior to or during the collection, unless there is a law stating that it can be done. In this regard, the company and / or subsidiaries must do so expressly request for the consent from the personal data owner in writing or by electronic methods, unless otherwise required by law.

In the event that sensitive information is collected, the Company and/or its subsidiaries must always obtain the explicit consent of the personal data owner, unless there is a law stating that it can be done.

2. Before or during the personal data collection, the company and/or its subsidiaries will notify the owner of the following details, unless the owner already knows the details:

  1. Inform the purpose of the data collection
  2. Notify the owner of the personal data in case it is necessary to provide personal data in order to comply with a law or contract, or if it is necessary to provide personal data to enter into a contract, including informing the impacts that may arise from the failure to provide personal data
  3. Personal data to be collected and the duration of collection. In this regard, in case such period cannot be clearly determined, define the expected duration according to the standards of the collection.
  4. Type of persons or external entities to which the personal data collected may be disclosed.
  5. Information about the agencies that collect the personal data. Contact place and contact method. In case the agent or a personal data protection officer is used, provide information, contact place and the contact method of an agent or a personal data protection officer too.
  6. Rights that personal data owner should receive.

3. The Company and/or its subsidiaries will not collect personal data from sources other than directly from the personal data owner, unless it is a case where the law stating that it can be done.

4. The Company and/or its subsidiaries will record the following transactions, so that the personal data owner can be verified. The record can be done in the book or electronic system

  1. Personal data collected
  2. Purpose for collecting each type of information
  3. Information about the entity of the Company and/or its subsidiaries that store personal data
  4. The retention period of personal data
  5. Rights and methods to access to personal data, including the conditions about the persona who are eligible to access the personal data and the conditions for accessing that personal data
  6. The use of disclosure of personal data that is exempted by law to be collected without consent
  7. Report the refusal to view or disclose, or obtain personal data or objection from the data subject as required by law together with reason
  8. Explanation of safety and security measures that the Company and/or its subsidiaries are obliged to perform.

Use or disclosure of personal data

1. The Company and/or its Subsidiaries will not use or disclose the personal data of the owner in any aspect without the consent of the owner, unless it is personal data that can be collected without obtaining consent as stating by law or the law states that it can be done.

2. The Company and/or subsidiaries will supervise the operators of the company and/or subsidiaries to not using or disclosing personal data of the owner in any way other than for objectives of the Company and / or its subsidiaries, unless

  1. obtaining consent from the personal data owner
  2. There is a law stating that it can be done.

3. Personal data will be collected for using or disclosing between the Company and/or its subsidiaries. In the event that the Company and/or its subsidiaries allow individuals or third parties to access or use the personal data of the owner, the Company and/or subsidiaries will take actions as necessary and to follow the objectives and authorities and duties of the Company and/or its subsidiaries. Apart from that, the company and/or its subsidiaries must always obtain the consent of the personal data owner first.

Withdrawal of Consent : The owner of personal data can withdraw the consent given to the Company and/or its subsidiaries at any time, subject to legal restrictions. In this regard, this is not a prejudice to the Company and/or its subsidiaries to use or disclose personal data for any other purposes that the personal data owner has not withdrawn his consent.

Security of Personal Data : The Company and/or its subsidiaries have appropriate security measures for information technology systems to prevent the loss, access, use, alteration, modification or disclosure of personal data without authority or improperly. This is set out in the Group's Information Technology Security Policy.

Personal Data Retention Period : The Company and/or its subsidiaries will retain the personal data of the owner for only as long as necessary to achieve the Company and/or subsidiaries’ objectives of the storage as specified in this privacy policy unless otherwise required by law.

Rights of the Personal Data Owner

1.Right to access personal data

In the event that the personal data owner wishes to have access to the personal data related to themselves, the owner of the personal data can make requests in accordance with the rules and procedures set by the entity of the Company and/or its subsidiaries that possess the information. And when the entity of the Company and/or its subsidiaries have received the request, the entity must immediately report the existence or the details of such information to the personal data owner within the period specified by law and the owner of the personal data also has the following rights:

  1. Request for a copy of your personal data.
  2. Request to disclose the acquisition of personal data relating to them in case of the information which the owner has not given consent to collect. However, the entity of the Company and/or its subsidiary may deny the rights of the owner in the event that the law states that this can be done.
  3. Be aware of the person to whom the personal data will be disclosed.

2.Right to modify

If the personal data owner sees that any personal data about them is inaccurate, the personal data owner can notify the Company and/or its subsidiaries to correct or change their personal data or delete them.

3.Right to request the erasure or destruction of personal data

The personal data owner can exercise the right to request the Company and/or its subsidiaries to delete or destroy or render such personal data non-personally identifiable information under the conditions stipulated by law.

4.Right to object to collection, use or disclosure of personal data

Personal data owners have the right to object against the collection, use or disclosure of personal data about them at any time when they see that the collection, use or disclosure of that personal data is not for the benefit of the implementation of the objectives or for the benefit of various relevant operations, or to support or promote the operation according to the objectives of the Company and/or subsidiaries, unless it is personal data that the Company and/or its subsidiaries can collect without obtaining consent as required by law.

In this regard, the Company and/or its subsidiaries have the right to refuse to comply with any request that has harassment characteristic and/or risk to the privacy of others or the request that cannot be practically performed under any circumstances in the event that the Company and/or its subsidiaries refuse to comply with. The company and/or its subsidiaries must also notify the reason for the rejection of the request.

Modification to the Privacy Protection Policy: The Company and/or its subsidiaries may update or revise the Personal data Protection Policy without prior notice to the personal data owner. This is to be appropriate and consistent with the changes of operations of the Company and/or its subsidiaries.

Contact information: In case the data owner wishes to contact the Company and/or its subsidiaries about this Privacy Protection Policy. You can contact at ..

Eastern Water Resources Development and Management Public Company Limited

Fl. 23-26 EAST WATER BUILDING

1 Vipavadeerangsit 5, vipavadeerangsit Road, Jomphol, Jatujak, Bangkok 10900

Tel. +66 2272 1600

Fax. +66 2272 1601