Privacy notice

Privacy notice for the Lodge of Complaint and Whistleblowing

PTT Public Company Limited (hereinafter referred to as “PTT” or “we” or “our”) gives highest priority to the protection of the personal data of all related persons, and for the compliance with the laws concerning personal data protection, PTT then established this Personal Data Privacy Notice for your acknowledgement of details of the processing of personal data, whether it be the collection, use and disclosure (collectively referred to as “the processing”) that may be occurred:

when you lodge relevant complaints including the whistleblowing of corruption to us;
when PTT reaches out to you for the request of additional data concerning the complaint lodged by the other person;
when you committed action in a manner that causes damages to PTT whether it be the action against the property or the reputation of PTT including to inform you of the rights on your personal data and our contact channels as follow:

1. Purposes for the collection, use and disclosure of personal data

When there is a lodge of complaint or the whistleblowing of corruption to PTT, we may conduct the processing of your personal data by relying on relevant lawful basis for the following purposes:

Clause	Purposes	Lawful Basis
1	For contacting and inquiring additional information concerning the complaints in which you or other person have reported to us.	Legitimate Interest basis
2	For the proceedings in relation to the management of relevant complaints as well as the proceedings in accordance with internal procedures of PTT, for instance, the consideration to proceed, fact investigation, fact finding, fact inquiry or disciplinary investigation, the retention of data as the records of the proceedings, the retention and the use of data for risk management, audit supervision, the development of the products and the provision of services including the internal audit of the internal audit office and the proceedings in accordance with other internal procedures of PTT including the proceedings for the handling of complaint reported by external authorities such as the regulatory authorities.	Legitimate Interest basis
3	For the establishment, compliance, exercise or defense of legal claim and relevant legal proceedings including for using as the supporting evidence of the legal proceeding (if any) against related person as well as the proceedings for legal execution.	Legitimate interest and legal obligation basis
4	For the compliance with the relevant laws including the reporting and disclosure of data to the government authorities or any organization pursuant to laws or by court order.	Legal obligation basis

In the event that you are the third party, that is not the employee, vendor, or any person having transaction relating to PTT, and had committed any action in the manner that causes damages to

PTT, PTT may collect, use and disclose your personal data under relevant lawful basis for the following purposes:

Clause	Purposes	Lawful Basis
5	For contacting, inquiring, making an appointment or any contact including notifying you to suspend the action that causes damages to PTT or settle the dispute.	Legitimate Interest basis
6	For the proceedings in accordance with internal procedures of PTT such as the consideration to proceed, fact investigation, fact finding, fact inquiry or disciplinary investigation, the retention of data as the records of the proceedings, the retention and the use of data for risk management, audit supervision, the development of the products and the provision of services including the internal audit of the internal audit office and the proceedings in accordance with relevant internal procedures of PTT.	Legitimate Interest basis
7	For the establishment, compliance or exercise or defense of legal claim and other legal proceedings including for using as supporting evidence of the legal proceeding (if any) to related person as well as the proceedings for legal execution.	Legitimate interest and legal obligation basis
8	For the compliance with relevant laws including the reporting or the disclosure of information to government authorities or any organization pursuant to the laws or by court order.	Legal obligation basis

2. Personal Data which shall be collected

In case that you are the person who lodged a complaint or the whistleblower of the corruption, PTT shall collect your personal data through the form, letter or relevant documents in which you provided data for us or by other methods, that is, the requesting of the data from you directly; nonetheless, there may be some circumstances that we collect your personal data from other sources such as the data publicly disclosed on websites (such as the website of the Department of Business Development or the website of the National Anti-Corruption Commission, etc.) or the data that is capable for requesting a copy from the government authorities, or in case that you lodge a complaint to the regulatory authorities or other authorities, PTT may obtain your data from such authorities or PTT may receive your data from the case that you have been referred to in the complaint of other person, etc. In the event that you are the third party, that is not the employee, vendor, or any person having transaction relating to PTT, and have committed any action in the manner that causes damages to PTT, PTT may collect your personal data by directly requesting your personal data from you, or may collect your personal data from other sources such as inquiring from the witnesses of the incident, collecting the data publicly disclosed on websites or the data that is capable for requesting a copy from the government authorities, etc.

In this regard, the personal data that we shall collect are as follows:

2.1 General personal data

Identity data such as first name and last name, etc.;
Contact data such as address, phone number, email, Facebook, LINE ID or other social media accounts, etc.;
Other data such as occupation, workplace, position, details of the complaint, details of the action causing damages to PTT, etc.;
Data of financial status, data of the status of being bankrupt, data of personal assets (such as the disclosure of assets prior to accepting the position), shareholding data (only for the case that your complaint is related to such data or the case that PTT is required to use such data for supporting the legal proceeding).

2.2 Sensitive personal data

For the lodging of complaint or the whistleblowing of corruption, PTT has no intention to collect and use sensitive data such as religious and nationality, etc. of yours or other person for any specific purpose. You are not required to specify or refer to such data; nonetheless, some type of complaint which is directly related to the exercise of rights against PTT such as the claim for PTT to pay for damages or relevant compensations, etc., you may be required to provide sensitive data supplementing the complaint such as health data, data regarding disability, etc. For such case, PTT may collect your data for supporting the establishment, compliance or exercise or defense of legal claim. In this regard, if we will use such data for any other purpose apart from this, we shall request for your prior express consent (if necessary).

In the event that you are the third party, that is not the employee, vendor, or any person having transaction relating to PTT, and have committed any action in the manner that causes damages, PTT may collect sensitive personal data to the extent necessary for supporting the establishment, compliance or exercise or defense of legal claim. In this regard, if we will use such data for any other purposes apart from this, we shall request for your prior express consent (if necessary).

In general, PTT has no intention to collect and use religious and blood type data specified in your identification card for any specific purpose. In the event that you provided PTT the copy of your identification card, it is requested that you conceal such data. If you did not conceal such data, it shall be deemed that you authorized PTT to conceal those data and such document with concealed data shall be deemed valid and legally enforceable in all respects. In case that PTT is unable to conceal those data due to some technical limitation, PTT shall collect and use such data as a part of your identification documents only

3. Period for retention of personal data

PTT shall retain your personal data for the period necessary for the purposes of the collection, use or disclosure of personal data set out in this Privacy Notice. The criteria for the determination of the retention period are the period necessary for the compliance with the laws or the statutory prescription period, or for the establishment, compliance, exercise or defense of legal claim, or for other reasons in pursuant to the internal policies and rules in the organization of PTT.

4. Disclosure of personal data

In order to carry out the proceedings for the purposes set out in this Privacy Notice, PTT may disclose your personal data to the third party as follows:

Government authorities, independent organizations established pursuant to the laws or other authorities as prescribed by laws whether it be the disclosure pursuant to the laws prescribing PTT the duty to disclose such data, or the disclosure as requested by such authorities by the virtue of the laws such as the National Anti-Corruption Commission, State Audit Office, etc. and including the disclosure of data to the officers which exercise powers or perform duties according to the laws such as police, etc.;
Regulatory authorities of PTT such as Ministry of Energy or State Enterprise Policy Office, etc., in case that such authorities have powers according to the laws for the requesting of data or in case that such authorities submit the complaint for PTT’s consideration;
State authorities, independent organizations established pursuant to the laws or other authorities as prescribed by laws which have powers and duties to conduct inquiry, investigation, interrogation or to commence legal proceeding such as police, public prosecutor, court, etc.;
Agents, contractors/sub-contractors and/or service providers for any operation assigned by PTT such as legal advisors, insurance companies, etc.;
Companies in PTT Group, in case that the reported complaint is relating to the companies in PTT Group. Nonetheless, if you are the person who lodged a complaint or the whistleblower of the corruption or the witness pursuant to such complaint, PTT would like to inform you that we shall keep your personal data confidential pursuant to our internal policies and rules and shall not disclose the data to any person having no connection with the management and administration of such matter. In the event that it is necessary for us to disclose your personal data, we shall comply with our internal policies and rules as well as this Personal Data Privacy Notice and relevant laws.

5. Your rights as the owner of personal data

As the owner of personal data, you have the rights as prescribed in the Personal Data Protection Act B.E 2562 (2019). In this respect, you can exercise your relevant rights through the channels specified by PTT in Clause 7 or through PTT website, whereby you will be entitled to exercise the rights when the laws concerning personal data protection are applied to PTT. The relevant rights having details as follows:

5.1 Right to withdraw consent

In the event that PTT requests for your consent, you shall have the right to withdraw the consent for the processing of your personal data that has already given to PTT unless such withdrawal of consent is restricted by laws or by the agreement that provides you the benefits.

Such withdrawal of consent shall not affect the processing of personal data legally conducted according to your prior consent.

5.2 Right to access to personal data

You have the right to request for an access to and the request for the copy of your personal data under control of PTT, including to request PTT to disclose the acquisition of such data that you have not given consent to PTT.

5.3 Right to request for the submission or the transfer of personal data

You have the right to request PTT to transfer your personal data that you have given to PTT as prescribed by laws.

5.4 Right to object the collection, use or disclosure of personal data

You have the right to object the processing of data relating to you in respect of the collection, use or disclosure of your personal data as prescribed by laws.

5.5 Right to request for the erasure of personal data

You have the right to request PTT to delete your personal data as prescribed by laws. Nevertheless, PTT may store your personal data using electronic system pursuant to which some system may be unable to delete the data, and for such case, PTT shall destroy or cause such data to be unable to identify your identity.

5.6 Right to request the restriction of the use of personal data

You have the right to request PTT to restrict the use of your personal data as prescribed by laws.

5.7 Right to request for the rectification of personal data

If you found that the data controlled by PTT is incorrect or you have changed your personal data, you have the right to request PTT to correct your personal data so that such personal data be accurate, current, complete and shall not cause misunderstanding.

5.8 Right to lodge a complaint

You have the right to lodge a complaint with the competent officers under the Personal Data Protection Act B.E 2562 (2019) in case that PTT breaches or does not comply with such Act.

6. Amendment of this Privacy Notice

We may amend and update this Privacy Notice from time to time, and if there is such amendment, we will keep you posted through PTT website. If it is necessary to request for your consent, we will proceed to request additional consent from you.

7. Contact channels

If you have question or require further details concerning the protection of your personal data, the collection, use and disclose of your personal data, the exercising of your rights or if you have any complaint, you can contact PTT as per the following channels:

PTT (Public) Company Limited

Office Address : 555, Vibhavadi Rangsit Road, Chatuchak district,
Chatuchak subdistrict, Bangkok 10900
Telephone : 02-537 2300

Personal Data Protection Officer

Office Address : 555, Vibhavadi Rangsit Road, Chatuchak district,
Chatuchak subdistrict, Bangkok 10900
Telephone : 02-537 2300
Email : pttdpo@pttplc.com