PERSONAL DATA PROTECTION POLICY OF RCL GROUP

Personal Data Privacy Policy

This Personal Data Protection Policy (“Policy”) sets out terms and measures of RCL Group (RCI LABSCAN LIMITED, RCI Systems & Advanced Chemicals Company Limited and EOS Scientific Company Limited) and its affiliates as listed in the attachment of this Policy (collectively referred to as the "Company") for collection, use, and/or disclosure of Personal Data (as defined below).

The Company is well aware that in conducting the Company’s businesses, the Company may collect, use and/or disclose your Personal Data for the purposes set out in this Policy. (Please see section ‘Purposes of Personal Data Collection, Use, and Disclosure’ below for more details). The Company collects and uses various types of Personal Data. The type of Personal Data collected, used, or disclosed, as well as the purpose of doing so, varies depending on the circumstances, the nature of the products or services and/or the transaction you made with the Company.

The Company recognizes the importance of the protection of your Personal Data and will handle your Personal Data carefully and in accordance with the Personal Data Protection Act B.E. 2562 (2019), including all rules, regulations, notices, announcements, and orders issued under such law (collectively referred to as the “PDPA”).

Please read this Policy together with other notices issued by or to be issued by the Company, as well as other written agreements between you and the Company (if any). This Policy may be supplemented, amended, or updated from time to time as the Company may deem necessary or appropriate. The Company reserves the right to amend this Policy on the Company’s website or through any other channel without prior notice. Therefore, please refer to the latest policy for your information and further reference.

Personal Data

“Personal Data” means any information pertaining to any natural living person, which enables the direct or indirect identification of such person, including information defined as ‘personal data’ under the PDPA.

1. Where does the Company Collect Your Personal Data?

1.1. From You

The Company may receive your Personal Data directly from you in many cases, for example:

when you use the Company’s services or buy the Company’s products;
when you access/visit any of the Company's websites or information system (for example, the Company may receive your location and device information during the operation of the Company's websites or applications);
when you contact/visit the Company's office, branch or factory; and
when you contact the Company through offline or online channels, for example, letters, social media platform, telephone, email, etc.

1.2. From Other Sources

The Company may receive your Personal Data from other sources where you have given your consent to disclose your Personal Data. The Company may collect your Personal Data from third parties based on your consent or other legal basis permitted by the applicable laws. These third parties may include government agencies, the Company’s affiliates or business partners, including payment service providers, delivery or maintenance service partners, insurance company, third parties’ social media sites, marketing/advertising partners and/or other service providers. These third parties also include people related to you (including your family or friends).

The Company may receive your Personal Data from your employer or from the organization that you work for (“Your Employer Company”), as you may be appointed as a coordinator with the Company or to represent Your Employer Company in any existing or potential business relationship with the Company.

2. Combination of Personal Data Collected

For the purposes of responding your and/or Your Employer’s request or needs, as well as to provide you and/or Your Employer with the best products and services for the purposes set out in this Policy, the Company may combine your Personal Data provided to us with your other Personal Data which the Company has previously collected and retained. If you have several relationships with the Company, for example, being a user of the Company’s website and a direct customer of the Company, or if you represent both Your Employer Company and the users of the Company’s website, the Company may connect all of your Personal Data collected by the Company.

3. What Personal Data the Company may Collect, Use and/or Disclose?

The Company may collect, use and/or disclose your Personal Data as follows.

3.1. Personal Information and Contact Information

The Personal Data categorized herein may include your first name, last name, title, marital status, gender, date of birth, age, height, nationality, religion, photo, educational background, country and city of birth, signature, identification number, 12-digit code on the back of your identification card (Laser Code), passport number, other information that appears in your passport, social security number, vehicle registration number, taxpayer identification number, professional license number, lawyer license number, notarial services lawyer registration number, email address, phone number, address, name of your emergency contacts and their contact information, workplace, social media account, Line ID, WhatsApp Contact, Facebook ID, etc.

3.2. Transaction Information

The Personal Data categorized herein may include details of your purchase or use of services, history of purchase or use of services, transaction status, transaction history, customer status, ability to acquire and pay off loans, loan application or information used for credit assessment, payment and refund information, including bank account details, tax information, credit and debit card details, electronic payment details and transaction number, outstanding debt information and information collected to verify your identity on the website, including your username, password, and security questions.

3.3. Online and Technical Information

The Personal Data categorized herein may include technical information that directly or indirectly identifies you when using the Company’s website, such as your username, address, IP address, other devices ID, device model, browser used, GPS location and other online data, as well as other technical data, including login history, internet browser settings and information system, browsing data, cookies or other similar technologies.

3.4. Video and Audio Recordings

The Personal Data categorized herein may include video, audio and photographic information obtained by the Company when you visit the Company’s offices, branches, or factories, through CCTV recordings, or from audio recordings of your telephone conversations with the Company's customer service personnel.

3.5. Sensitive Personal Data

The Personal Data categorized herein is sensitive Personal Data in accordance with the characteristics specified in the PDPA which may include information pertaining to your background (such as criminal record), disability, health information, religion, marital status, and biometric data including facial/iris recognition data, fingerprints, voice recognition data and other biometric identifiers. Due to the sensitive nature of Personal Data in this category, the Company will ensure that the collection, use, and/or disclosure of these sensitive Personal Data is based on necessity as permitted by laws or your explicit consent only.

3.6. Voluntarily Provided Information

The Personal Data categorized herein may include information that you provide to the Company in response to surveys, feedback, or other reviews on the Company's website or through other channels. This includes your Personal Data the Company receives through your social media account when you communicate or interact with the Company via social media pages and your Personal Data the Company receives from your participation in activities organized by the Company.

3.7. Personal Data of Minors and Incompetents

The Company does not wish to collect, use and/or disclose Personal Data of children, minors, incompetent and/or quasi-incompetent persons for any purpose except as permitted under the applicable law or with the prior consent of the legal guardian who has legal authority to act on such person’s behalf.

4. Purposes of Personal Data Collection, Use, And Disclosure

4.1. Business Operations and Carrying Out the Contractual Obligations of the Company

For operating the Company’s business and carrying out the Company’s contractual obligations related to the Company's business operations, as well as for the provision of products and/or services to you and/or Your Employer Company, the Company may collect, use, and/or disclose your Personal Data for the following purposes:

allowing you and/or Your Employer Company to use the Company's products and/or services;
verifying your and/or Your Employer Company’s identity in any transaction;
processing your and/or Your Employer Company’s requests before entering into a contract with the Company;
registering you and/or Your Employer Company as the Company’s customer or partner, a person interested in the Company’s products or services, a user of the Company’s website or other information technology, and to verify and maintain the accuracy of your or Your Employer Company’s user account;
processing and performing tasks in accordance with your and/or Your Employer Company’s instructions (e.g., reservations or purchases of the Company’s products; notification of product, order, or service modifications; and procedures for obtaining relevant licenses, etc.);
delivering products and services to you and/or Your Employer Company, provided that the Company may send your Personal Data to third parties for the delivery of such products/services;
maintaining a client account that you and/or Your Employer Company have with the Company;
enabling the Company’s website to function efficiently and effectively;
taking necessary actions to provide and enhance the Company’s website;
ensuring your and/or Your Employer Company’s security and privacy while using the Company’s products, services, or website;
handling your and/or Your Employer Company’s payments and other related expenses;
verifying and processing your and/or Your Employer Company’s electronic payments;
assist you and/or Your Employer Company through the Company's after-sales service;
issuing invoices, receipts or other documents related;
providing customer assistance and support services;
processing your and/or Your Employer Company’s requests, questions, inquiries and complaints;
offering privileges, rewards, and discounts through a customer retention program (if any); and
taking any actions in connection with the contract you and/or Your Employer Company have with the Company.

4.2. Fulfilling of the Company’s Legal Obligations

The Company may collect, use, and/or disclose your Personal Data in order for the Company to comply with the legal obligations under the applicable laws, including taxation laws, anti-money laundering laws, computer crime laws, PDPA, etc., including rules, regulations and/or other orders of competent authorities.

4.3. As Necessary for Legitimate Interests

The Company may collect, use, and/or disclose your Personal Data in order to enable the Company to perform any act for the legitimate interests of the Company or that of another person as reasonably and permitted under the applicable laws. For example, to prevent cyber-crime or fraud, to ensure safety and security of the workplace, the Company’s officer or the network systems, to be used for audits or investigations, to handle claims and dispute, and to comply with applicable foreign legal and compliance regulations, etc.

4.4. Improving the Company's Products and Services and Marketing Purposes (Only with Your Consent)

To improve the Company’s products and services, marketing or marketing campaigns, advertisements, and promotions, as well as other developments, in order for you to have a better experience when contacting the Company through any channel, if you have given consent to the Company, the Company may collect, use, and/or disclose your Personal Data for the following purposes:

notifying you of the Company’s news and product information, as well as offering you special offers and the most recent promotions;
sending you notifications, offers, campaigns, and materials for the Company’s future events, promotions, offers, and other privileges;
conducting marketing research and business development and/or surveys to improve the Company’s website, products, and services, as well as preparing the Company’s marketing plans;
conducting an analysis of your preferences and interests;
providing recommendations in connection with the Company’s product and/or services, the Company’s benefits, rewards, and promotions, which may be based on your preferences and interests; and
providing recommendations, benefits, rewards, and promotions in connection with products and/or services of the Company's affiliates and business partners.

The collection, use, and disclosure of Personal Data in this section depends on your consent. Withdrawing your consent is a legal right. The withdrawal of your consent in this regard may affect services, communications, facilities, and your ability to access any benefits, including improvements to products and services that the Company may offer you.

4.5. Others

In addition to the foregoing, the Company may collect, use, and/or disclose your Personal Data for the following purposes: (i) conducting research and statistics; (ii) preventing or suppressing a danger to the life, body, or health of any person; (iii) taking any action in the public interest or as necessary to exercise the powers and duties conferred upon the Company by the authorities; and/or (iv) other purposes permitted by applicable laws.

The Company will collect, use, and/or disclose your Personal Data only for the purposes specified in this Policy or with your consent. In the event that the Company needs to use and/or disclose your Personal Data for other purposes, the Company will notify you and elaborate the applicable legal basis involved.

5. Retaining and Disclosure of Personal Data

Personal Data collected by the Company will be properly retained in compliance with appropriate security measures, including physical, technical, and organizational measures to prevent any data breach or loss and to ensure the security of data. The Company has implemented internal policies and regulations, including data confidentiality policies, as well as training for the Company’s staff and representatives to protect against any misuse or unlawful use of and access to Personal Data. The internal policies, regulations, and training are constantly updated as the Company deems appropriate and necessary.

Based on your consent and/or as permitted by the applicable laws, the Company may disclose your Personal Data to third party in Thailand and/or overseas who is contractually obligated to the Company to keep your Personal Data safe and secure. In addition, the Company will collect, use, and disclose the Personal Data in the scope of your consent or as specified in this Policy. These third parties may include the following:

the Company’s affiliates, subsidiaries and parent companies, as well as the Company’s directors, employees, agents or consultants;
Your Employer Company;
the Company’s business partners and customers;
the Company’s payment processors and/or payment facilitators;
third party who provide services to the Company (e.g., cloud service providers, application/website developer and other IT service providers that supports the Company's system, website and other business operations, marketing research provider, advertising/marketing agency, recruitment and/or human resource providers, carrier service provider, auditors, legal advisors, and other consultants);
the Company’s data processors;
financial institutions;
persons involved in a potential merger or acquisition of the Company’s shares, assets, or businesses;
regulators and governmental agencies;
hospitals /medical facilities;
training institutes;
insurance companies;
contractors, including their agents, employees and assignees; and
any person for whom you have instructed the Company to disclose your Personal Data.

When necessary or appropriate, the Company may disclose your Personal Data outside of Thailand, for example, the Company may disclose your Personal Data to the Company’s subsidiary or parent company overseas (if any) or to a cloud service provider located in a foreign country. Nonetheless, the Company will ensure that your Personal Data is protected by sufficient procedures and methods for securing the safety and security of Personal Data, which may include having non-disclosure agreements, internal Personal Data protection policies, or other documents required by laws in order to establish adequate protection of Personal Data.

6. Cookies

Cookies are small text files stored in the browser directory of your computer. In general, when you use your internet browser to visit the websites, cookies will serve as tracking functions to enhance the performance of the website and to improve the Company’s security of information system.

The Company uses cookies according to their types and purposes as follow.

6.1. Strictly Necessary Cookies

Strictly Necessary Cookies are required for browsing a website and for the website to operate efficiently, allowing you to access and use the Company's website effectively. Nonetheless, you cannot disable these cookies through the system on the Company’s website.

6.2. Functional Cookies

Functional Cookies collect your data while you are using the Company’s website, including your personal preferences, preferred language, etc., and customize the website to your preferences when you return.

6.3. Analytic/Performance Cookies

Analytic/Performance Cookies collect data that helps to customize the use of the website. These cookies track and collect your website usage behavior, including activities, time spent and other data. The data collected will help the Company to improve the functionality of the Company’s website and provide you with a better website experience.

6.4. Advertising Cookies

Advertising Cookies collect your behavior and history while you are using a website. The data collected enables the Company to present or provide services, products and advertisements tailored to you based on your specific preferences.

You can disable cookies or restrict access to cookies on your browser if the cookies are not Strictly Necessary Cookies. However, certain features and experiences from us may be limited if you do not accept some certain cookies.

7. Website Connection to External Parties

The Company's website may be linked to other websites of a third party for the purpose of providing/offering additional information or benefits to you. The third party operating the website may collect data regarding your use of the website. The date collected by the third party may be the data that you provided through the Company’s website. The collection, use or disclosure of your Personal Data in such cases will be in accordance with the cookies policy or the data privacy policy of that third party. You may need to read the third-party policies as well.

8. How Long does the Company Retain Your Personal Data?

In general, the Company only retains your Personal Data for as long as necessary and required for the Company to: (i) fulfill our contractual obligations that the Company has with you; and (ii) fulfill other purposes as prescribed in this Policy or as long as legally required by the applicable laws. Normally, the Company will retain your Personal Data for a period of not more than [10] years after the termination/cessation of the relationship between you and the Company or within the period of exercising the legal claims of the parties, unless the Company has the legal right to retain your Personal Data for longer period.

9. Your Rights as a Data Subject

Subject to the appliable laws, you, as a data subject, are entitled to the following rights.

9.1. You may withdraw your consent given to the Company pursuant to this Policy at any time. However, withdrawal of your consent may result in limited services being provided to you or the Company may be unable to offer you any other benefits. Please note that withdrawing of your consent does not affect the Company’s rights to collect, use and disclose your Personal Data that has been done under your consent. In addition, the Company has the right to collect, use or disclose your Personal Data without your consent if permitted by laws.

9.2. You may access to and request copies of your Personal Data collected and retained by the Company as well as disclosure of the collection of such Personal Data without your consent.

9.3. You may request to update the outdated, inaccurate, or incomplete of your Personal Data to be up-to-date, complete, and not misleading.

9.4. You may request the Company to have your Personal Data erased, or destroyed, or anonymized in certain cases as required by the PDPA, including when your Personal Data collected by the Company is no longer necessary, when you withdraw your consent to collect, use or disclose such Personal Data, when you object to the collection, use, and/or disclosure of your Personal Data by the Company, or when your Personal Data has been unlawfully collected, processed and/or disclosed.

9.5. You may request the Company to suspend the use of your Personal Data in certain cases as prescribed by the PDPA, including when the Company is in the process of verifying your request and when your Personal Data has been unlawfully collected, used, or disclosed but you request to suspend the use instead.

9.6. You may request the transfer of your Personal Data from the Company to another person.

9.7. You may, at any time, challenge the Company’s collection, use, and/or disclosure of your Personal Data for the purposes of serving public interests as prescribed in Section 24(4) of the PDPA, serving legitimate interests as prescribed in section 24(5) of the PDPA, direct marketing purposes, or for scientific, historical, or statistical research purposes as prescribed in Section 32(3) of the PDPA. Nonetheless, the Company may continue to collect, use, and/or disclose your Personal Data if the Company can demonstrate compelling legitimacy interest or can prove that it is necessary for establishment of a legal claim, complying with or exercising a legal claim, or defending against legal claims.

9.8. You may file a complaint with the Personal Data Protection Committee if you believe that the Company is violating the PDPA.

To exercise your rights specified above, please contact the Company in writing using the contact information provided below. However, please be informed that the exercising of these rights is subject to the applicable laws and there will be circumstances where the Company will have to reject your request, for example, if your request infringes on another person’s rights, etc. In this circumstance, the Company will let you know the reason for rejection. Normally, to process your request, the Company will take approximately [15-30] days from the date the Company receives the request with sufficient information and documents.

Contact Us

RCL GROUP

Data Protection Officer : Data Protection Officer (DPO)

Address: 24 Rama 1 Road, Rongmuang, Pathumwan, Bangkok 10330 Thailand

Tel: (662) 2613-7913

Email : DPO@RCILABSCAN.COM

10. Modification

The Company reserves the right to update, amend, or supplement this Policy from time to time at its sole discretion. You can check whether there are any revisions by referring to the date on which this Policy was last updated, provided that the revision shall take effect immediately upon the Company's publication of the revised Policy on the Company’s website or application.

11. Use of Previously Collected Personal Data

The Company has the legal right to collect, use, or disclose your Personal Data that the Company collected prior to the enforcement of the PDPA as long as it is consistent with the original purposes. If you do not wish for the Company to continue collecting, using, and/or disclosing such Personal Data or wish to challenge or restrict such action in any way, please contact the Company using the contact information provided below.

RCL GROUP

Data Protection Officer : Data Protection Officer (DPO)

Address: 24 Rama 1 Road, Rongmuang, Pathumwan, Bangkok 10330 Thailand

Tel: (662) 2613-7913

Email : DPO@RCILABSCAN.COM

This is from August 25, 2023 onwards : Ms. Panarat Viprakasit (President)

Attachment of the Personal Data Protection Policy

The Company’s affiliates are as follows:

VS Chem (1970) Limited;
VS Surface Technology Company Limited;
VS Ingredients Company Limited;
Nitro Chemical Industry Limited;
Nobel Nc Company Limited;
Fibre Pak Company Limited;
RCI Labscan Limited;
RCI Systems & Advanced Chemicals Company Limited; and
EOS Scientific Company Limited.