CCTV Privacy Notice

1. Introduction

This Notice is issued by Wisesight (Thailand) Co., Ltd. (hereinafter referred to as the "Company" or "Wisesight") to describe the use of closed-circuit television (CCTV) for image recording and the processing of image data on the Company's premises.

This is to ensure that data subjects receive the information required under the Personal Data Protection Act B.E. 2562 (2019) (the "PDPA").

This Notice applies to image recording via CCTV installed and administered by the Company on the Company's premises, being the Company's head office at Suntowers Building B, 33rd Floor, Vibhavadi Rangsit Road, Bangkok, and is addressed to the following persons:

Employees, workers, and contractors of the Company.
Visitors, clients, business partners, and business contacts.
Delivery persons, transport providers, cleaning providers, and maintenance providers.
Any person entering the Company's premises.

2. Categories of Personal Data Processed

The Company's CCTV records the following data:

Image data

Moving images of persons entering areas covered by CCTV.
Facial images of persons (to the extent captured by the cameras).
External appearance of persons (clothing, visible physical characteristics).
Activities and behaviour of persons within the recorded areas.
Property carried or moved by persons.

Data relating to the recording

Date and time of recording.
Position of the recording camera (area within the office).
Camera number.

Sensitive personal data

In general, CCTV recording does not have the purpose of collecting sensitive personal data under Section 26 of the PDPA. However, recorded images may display characteristics indicating:

Race, as apparent from external appearance.
Religion, as apparent from clothing (e.g., head coverings, amulets).
Disability, as apparent.

3. Purposes and Lawful Bases of Processing

Security of persons and property on the Company's premises — legitimate interest (Section 24(5)).
Prevention and detection of unauthorised access — legitimate interest.
Investigation of incidents occurring in the office (e.g., theft, disciplinary breaches, accidents) — legitimate interest.
Establishment, exercise, or defence of legal claims — legitimate interest.
Compliance with orders of government authorities and law enforcement agencies — legal obligation.
Protection of the life, body, or health of persons in emergencies — vital interest concerning life, body, or health (Section 24(2)).

4. Data Recipients and External Data Processors

The Company may disclose your personal data to the following persons or categories of persons, to the extent necessary and consistent with the purposes of processing and the lawful bases:

Designated employees (Security, Administration, IT) on a need-to-know basis.
Supervisors assigned to investigate incidents.
The CCTV system provider in the capacity of data processor, for the maintenance and administration of the system.
Security service providers if the Company engages external monitoring services.
The building owner and building management, to the extent the Company's cameras are interconnected or coordination is required.
Law enforcement agencies, where there is a lawful order, court warrant, or a request from police officers in the case of a criminal investigation.
Legal advisers, in the case of litigation or related disputes.
Insurance companies, in the case of claims arising from recorded incidents.

5. Cross-Border Transfer of Personal Data

Most processing and storage takes place in the cloud systems of Amazon Web Services and Google located in the Republic of Singapore.

In some cases, data may be transferred to other countries for the provision of services by external data processors, in which case the Company will ensure appropriate protection mechanisms as required by law.

6. Retention of Personal Data

CCTV images are retained for a period of 30 to 90 days from the date of recording, after which the images are automatically overwritten according to the system's cycle.

7. Data Protection Officer (DPO)

The Company has appointed a Data Protection Officer pursuant to Section 41 of the PDPA to provide advice, monitor compliance with the law, coordinate with the Office of the Personal Data Protection Committee (PDPC), and receive complaints from data subjects.

DPO contact details:

Email: dpo@wisesight.com
Address: 123 Suntowers Building B, 33rd Floor, Unit B3301–3304, Vibhavadi Rangsit Road, Chomphon Sub-district, Chatuchak District, Bangkok 10900
Telephone: 022741299

8. Rights of Data Subjects

Under the PDPA, data subjects have the following rights; the details and procedures for exercising each right appear in the relevant privacy notice:

Right to be informed. The Company will provide a "Privacy Notice" containing clear details of the purposes of processing, together with a "Cookie Policy" setting out the categories of cookie technologies the Company uses and the purposes of using such cookie technologies; and in the event that the Company processes data other than in accordance with those purposes, or outside the scope of any consent given, the Company will notify and/or seek consent from the data subject before processing personal data outside such purposes.
Right to withdraw consent. The data subject may withdraw consent previously given to the Company at any time.
Right of access. The data subject may request access to his or her personal data and a copy of the personal data processing activities, and may request that the Company disclose how such data was obtained.
Right to rectification. The data subject may request the correction of inaccurate personal data so that such data is accurate, up to date, and not misleading.
Right to erasure. The data subject may request that the Company delete or destroy personal data, or render personal data anonymous such that the data subject can no longer be identified.
Right to data portability. Where the Company's data systems support reading or use by generally available automated tools or devices, and the personal data can be used or disclosed by automated means, the data subject may request a copy of his or her personal data, request the automatic transfer of such data to another data controller, and request to receive the personal data so sent or transferred.
Right to restriction of processing. The data subject has the right to request that the Company restrict the use of personal data.
Right to object. The data subject may object to the processing of personal data.

Channels for Exercising Rights

Data subjects may exercise the above rights through the following channels:

Online DSAR form at https://wisesight.com/legal-and-privacy/data-subject-request
Email: dpo@wisesight.com
Written correspondence addressed directly to the DPO at the Company's office address.

9. Complaints and Contact Channels

Internal channel — data subjects may lodge complaints with the Company directly through the DPO via the channels specified.
Government channel — where a data subject is dissatisfied with the Company's handling of a matter, or wishes to lodge a complaint directly with a government authority, the data subject may contact: Office of the Personal Data Protection Committee (PDPC). Address: 7th Floor, Ratthaprasasanabhakti Building, The Government Complex, 120 Moo 3, Chaengwattana Road, Thung Song Hong Sub-district, Lak Si District, Bangkok 10210. Telephone: 02-142-1033. Email: saraban@pdpc.or.th. Website: https://www.pdpc.or.th

10. Review and Amendment

Review — The Company will review this Policy at least once a year, or upon a change in law, in PDPC guidance, or a material change in the business.
Amendment — The Company will announce amendments to employees and affected data subjects through the Company's website and appropriate internal channels.
Effectiveness — Amendments take effect on the date of announcement or the date specified in the announcement, whichever occurs later.