We, SCB Tech X Company Limited (“the Company”), care about the privacy of our employees, workers, service providers and contractors (“you”). Thus, we provide this Privacy Notice under the Personal Data Protection Act B.E. 2562 (“PDPA”) to inform you of (a) the methods, objectives and details of the data that we collect, store, use or disclose (b) duration of data collection; (c) disclosure of personal data; (d) your rights as the owner of personal data; and (e) the keeping of privacy and security of personal data and how you can contact us. 

This Privacy Notice applies to the following natural persons: 

(1) Employees or workers of the Company pursuant to employment agreements; 

(2) Service providers and contractors of the Company, including their employees or staff under the agreements with the Company (e.g. service agreement, hire of work agreement, agency contract) including its employee or staff; 

(3) Job applicants, whether they are applying directly with the Company, or through agency or other entities; 

(4) Former employees, of whom the Company needs to retain or use their personal data as required by laws; 

(5) Parents, descendants, relatives, spouses, or beneficiaries of employees; 

(6) Guarantors of employees, staff, service providers or contractors under the employment agreements, service agreements, hire of work agreements, agency contracts or other similar agreements with the Company; 

(7) Speakers, lecturers, and trainers in company training programs, including doctors and nurses who provide services at company premises for training courses organized by the Company; 

(8) Trainees or participants in projects or activities organized or participated by the Company; 

(9) Directors, advisors, or authorized persons of the Company; 

(10) Employees of companies in SCBX Group; 

(11) Reference persons in job applications or other contracts made with the Company; 

(12) Student trainees, scholarship students of the Company including their guarantors or other relevant persons; and 

(13) Any natural person entering into contract or participating in any activity (whether directly or indirectly) with the Company for the purposes stated in this Privacy Notice.  

1. How the Company collects, uses, and discloses your personal data 

The Company will only collect, use or disclose your personal data when it is necessary, or where there is a lawful basis to do so. This includes where the Company collects, uses or discloses your personal data based on (a) legal obligations; (b) performance of contract; (c) legitimate interests; (d) consent and/or (e) other lawful bases for the following purposes: 

1.1. Legal obligations of the Company  

As the Company is subject to supervision and regulations and must comply with appliable laws and regulations, it is necessary for the Company to collect, use or disclose your personal data for various reasons as required by the following laws and governmental regulations: 

(1) the Personal Data Protection Act;  

(2) the Civil and Commercial Code, Labour Protection Act, Labour Relations Act including other relevant labour laws; 

(3) the Social Security Act, Provident Fund Act, Workmen Compensation Act, Cremation Fund Act, or other laws relating to the provision of welfare for employees or workers; 

(4) the Empowerment of Persons with Disabilities Act, Skill Development Promotion Act and/or other relevant laws; 

(5) the Revenue Code or other tax laws; 

(6) the Orders and regulations issued by government authorities, such as court orders, orders from governmental or supervisory agencies, or regulatory authorities, etc.; 

(7) the Anti-money laundering and suppression of terrorism funding (AML/CFT) laws; 

(8) Checking of background, assets or securities holding of employees as required by laws, including reports made to relevant regulatory or governmental authorities; and 

(9) Checking and verifying of background or qualifications for the appointment of executives or other key positions as required by rules and regulations issued by relevant regulatory authorities or other relevant laws. 

1.2. Performance of contract made between you and the Company 

The Company will collect, use and disclose your personal data in accordance with application documents, agreements or contracts made between you and the Company and for the purposes stated therein, as follows: 

(1) Job application, recruitment, interview, questionnaire, performance assessment of the candidate; 

(2) Employment, negotiation, employment approval, preparation, modification, change, renewal, or any other actions with respect to employment agreements and/or agency agreements, including change of working conditions; 

(3) Preparation of employee profile registration, book-keeping of employee profile registration on the Company’s system, including to create, delete, edit employees’ personal data and grant or revoke the rights of the employee; 

(4) Preparation of payroll and calculation of wages, salaries or compensations to be paid by the Company to you, including making payments or setting aside workers compensation reserves; 

(5) Arrangement for welfare, benefits, payments, loans, credits and reimbursements concerning welfare programs granted by the Company to employees; 

(6) Arrangement, change, or cancellation of health insurance, life insurance, accidental insurance or other types of insurances; 

(7) Grant, permission or alteration, deletion and control of the rights to access or use the Company’s assets or systems; 

(8) Arrangement and provision of office equipment and supplies for employees and sales agents e.g. uniform, name cards, signs, licenses, computers and mobiles distribution and employee or sales agent cards, including arrangement for returning of the same upon employment termination; 

(9) Review and assessment for the appointment of executives or other key positions;  

(10) Compliances with the employment agreement work rules, regulations and orders of the Company; 

(11) Record and management of data concerning employees’ leaves and 

entitlement; 

(12) Performance review and job assessment; 

(13) Grant of scholarships and internship; 

(14) Arrangements relating to termination or expiration of the employment agreement between the Company and employee, including retirement; 

(15) Organisation of activities by internal and external personnel; 

(16) Arrangement in relation to any internal and external trainings, license acquisition, projects or employees’ or agents’ capacity development programs, including issuance of training certificates or licenses; 

(17) Communications and announcements to employees related to the performance of contract via any communication channels; 

(18) Use of any third-party services to perform the duties under the contract between you and the Company  

(19) Preparation of Power of Attorney; 

(20) Preparation of salary certificate, income statement, work certificate, or other certificates concerning employment, agency, or other types of service agreements; 

(21) The analysis, evaluation, and report preparation through the Company’s system for considering performance and improving employee’s work efficiency; 

(22) The collection, use or disclosure of your personal data provided to the Company and/or the companies in SCBX Group for the purpose of analysing and summarizing the overall Employee Survey, as well as for the benefit of managing human resources within SCBX Group; and 

(23) The disclosure of your employment status to third parties via telephone or other channels, based on specific prior requests you have submitted to the Company on a case-by-case basis. 

(24) Preparation of employee profile for any project proposals to customers.

1.3. Legitimate interests of the Company 

The Company relies on the legitimate interests by balancing the nature of your personal data that the Company collects, uses and discloses with the normal reasonable expectations and provide safeguards to reduce any negative impacts on your fundamental rights and freedoms. This may include processing your personal data to: 

(1) Use personal data of non-applicants during the process of recruitment, interview and assessment of applicants, including to store the personal data of the beneficiaries of employees; 

(2) Perform duties under a contract between the Company and another person, where your personal data is necessary but you are not a contractual party;  

(3) Record and keep personal data on the Company’s internal storage system; 

(4) Enhance staff knowledge and capabilities including relevant management and planning for corporate structuring projects;  

(5) Pursue safety and business continuity measures of the Company, the companies within SCBX Group (as listed at https://www.scbx.com/en/affiliates-financial-business-group/, and SCBX Group as a whole, including governance, auditing, risk management regarding internal personnel, and reporting operational incidents; 

(6) Conduct employee and agent background check of the companies within SCBX Group and SCBX Group as a whole;  

(7) Perform the Company’s accounting, financial, or other internal management operations; 

(8) Undertake measures and actions towards surveillance, prevention, investigation, complaint handling, investigation of suspicious behaviours, or fraudulent behaviours, money laundering, and terrorism misconduct, including actions to prevent such incidents; 

(9) Undertake and record of disciplinary action, make criminal report, give statements or information to the police, competence officer, court and other competent authorities; 

(10) Take action relating to disputes, dispute resolution including establish, exercise, or defend the legal claim; 

(11) Provide and disclose of information regarding employee status, employment information, human resource management, salary framework development, benefits, compensation, and employee welfare to third parties, such as companies within SCBX Group, etc., for the purpose of analysis and improvement to ensure alignment with the policies and standards of the companies in SCBX Group; 

(12) Prepare reports for the Company’s internal departments including questionnaires, collecting, and analysing various data to support the work within the organisation or for planning, management, implementation of administrative measures, workforce development, or any related activities;  

(13) Make travel and accommodations or other facilities arrangements for employees, such as ticket and hotel reservations, meals, etc.; 

(14) Communicate with and make announcement to employees via any channels. This includes conversations conducted through channels established by the Company utilizing current or future technologies possessed by the Company, such as Chatbots, etc.; and 

(15) Membership process for cooperatives and cremation fund  

1.4. Consent 

Normally, the Company will not collect, use or disclose your personal data if the Company does not have any lawful bases to do so. However, if necessary, the Company will ask for your consent to collect, use or disclose your personal data for your benefits the following purposes: 

(1) The Company deems it necessary to collect and use sensitive personal data, for example, for the purposes of authentication (identity verification), criminal record checks, or providing health-related benefits and welfare to employees, etc.; 

(2) Checking the background of employees or agents within SCBX Group (in cases where consent is required under the PDPA); 

(3) Sending or transferring your personal data and sensitive personal data internationally, where the standards for personal data protection may be inadequate (unless the PDPA permits such action under other legal bases or without obtaining consent); and 

(4) When the data subject is classified as a minor, quasi-incompetent or incompetent whose consent must be given by their parent, guardian or curator (as the case may be). 

1.5. Other lawful bases 

Apart from the above lawful bases, other lawful bases that the Company may rely on the following bases when collecting, using or disclosing your personal: 

(1) Prepare historical documents or archives for the public interest, or purposes relating to research or statistics; 

(2) Believe that the use of your personal data is of vital interest or to prevent or suppress a danger to a person’s life, body or health; or 

(3) Believe that the use of your personal data is necessary to carry out a public task, or exercise official authority. 

In addition, the Company may utilize technologies currently possessed or to be acquired in the future for the collection, use, or disclosure of your personal data in accordance with the purposes stated in clauses 1.1 – 1.5 above, including, but not limited to, Artificial Intelligence (“AI”), Generative AI Usage, such as AI Chatbot technology, Cloud Computing, etc. 

Furthermore, the Company may establish the system(s) to support operations and business activities for shared use within SCBX Group and may collect, use, or disclose your personal data held by the Company and the companies in SCBX Group through such system(s) in accordance with the PDPA. 

2. What personal data the Company collects 

The personal data that the Company collects may vary depending on the objectives and necessities and may include both general and sensitive personal data.  

Your personal data that the Company collects, uses, and discloses are as follows: