Privacy Notice — Employees, Applicants and Contractors

1. Introduction

This Privacy Notice is issued by Wisesight (Thailand) Co., Ltd. (hereinafter referred to as the "Company" or "Wisesight") to describe the collection, use, and disclosure of the personal data of persons in an employment or engagement relationship with the Company.

This is to ensure that data subjects receive the information required under the Personal Data Protection Act B.E. 2562 (2019) (the "PDPA").

This Notice is addressed to the following groups of persons:

Job Applicants / Candidates — persons who apply for work with the Company through any channel, whether or not selected.
Employees — persons in an employment-contract relationship with the Company, including permanent employees, probationary employees, temporary employees, part-time employees, and interns.
Individual Contractors — persons with whom the Company enters into a hire-of-work (จ้างทำของ) contract or a fixed-engagement contract, not in the capacity of employees.
Directors and senior executives — to the extent relating to the holding of office and responsibilities within the Company.
Former employees, former workers, and former contractors — to the extent the Company continues to process data for lawful purposes.

2. Collection of Personal Data

Collection directly from the data subject

Job applications, résumés, and supporting application documents.
Completion of forms through the Applicant Tracking System (ATS) or the Company's recruitment website.
Interviews, tests, and assessments connected with selection.
Completion of forms and submission of documents in the onboarding process.
Performance of work and use of the Company's systems during employment.
Performance appraisals, feedback, and personnel development.
Notifications and requests through HR, internal systems, or supervisors.

Collection from sources other than directly from the data subject

Recruitment agencies and headhunters.
Job platforms (e.g., JobsDB, LinkedIn, JobThai, Indeed).
Referrals from current employees (employee referrals).
Background check results from designated service providers.
Criminal record checks from the Police Department or licensed service providers (to the extent permitted by law and as consented to by you).
Information from references you have nominated.
Publicly available information on professional platforms (LinkedIn, etc.).
Health examination results from hospitals or clinics to which the Company refers you.

3. Categories of Personal Data Processed

General personal and contact data

Full name (including title).
Gender.
Date of birth.
Nationality.
Contactable address.
Telephone number.
Email address.
Professional social media accounts (LinkedIn, etc., as disclosed by you).
Photographs for use in the Company's systems and on employee ID cards.
Marital status and family information (for tax allowances and benefits).
Emergency contact information (name, relationship, telephone number).
Immigration and work permit information (for foreign nationals).
Military service information (for Thai males).

Education and work experience data

Educational history (institution, qualification, year of graduation, academic results).
Professional certificates and diplomas.
Employment history (employer names, positions, durations, scope of work).
Skills and areas of expertise.
Languages used and proficiency levels.
Current salary and expected salary.

Interview and testing data

Interview records, assessments, and interviewers' comments.
Results of knowledge, skills, and attribute tests (e.g., personality tests).
Results of specialised skills tests (technical tests, case studies).
Audio/video recordings of interviews (only where the Company has obtained prior consent).

Data in contracts and business documents

Data in contracts, confirmation letters, memoranda of agreement.
Signatures (including electronic signatures).
Consents and authorisations stated in contracts.
Scope of signing authority.
Identity documents necessary for signing (e.g., a copy of the national identification card or a power of attorney).

References Person

Names and contact details of the references you nominate.
Statements and opinions given to the Company by the references.

Employment contract and position data

Job title and job function information.
Department, reporting line, and supervisor.
Grade and career path.
Start date; probation period.
Employment type (permanent/temporary/part-time/internship).
Scope of duties and responsibilities.

Remuneration and benefits data

Salary, wages, bonuses, and other remuneration.
Bank account details for salary transfers.
History of salary adjustments and bonus awards.
Provident fund data.
Social security and health insurance data.
Beneficiary data in respect of funds and insurance.
Personal income tax data.
Other benefits data (travel allowance, telephone allowance, meal allowance, etc.).
Expense and travel reimbursement history.

Work performance data

Time attendance records.
Leave (annual leave, personal leave, sick leave, maternity leave, other leave).
Overtime.
Remote work and place of work.
Work performance and appraisals (KPI/OKR, etc.).
Development and training.
Work assignments, projects, and team membership.
Achievements and awards received.

Disciplinary data and disciplinary proceedings

Issuance of warning letters.
Records of disciplinary investigations.
Disciplinary sanctions.
Internal complaints and dispute resolution.

Occupational health and safety data

Annual health examination results and pre-employment health examinations.
History of work-related illness and injury.
Health limitations that may affect work.
Health insurance claims.
Records of workplace accidents.
Safety, occupational health, and environment (SHE) data.

Data on the use of the Company's systems and property

User accounts and passwords in the Company's systems.
Company email address and the content of communications through the Company's systems.
System and application access logs.
Data on the use of the Company's computers, internet, and telephones.
Office entry/exit records (access card logs).
CCTV images.
Assigned property (laptop, equipment, etc.).
Execution of internal documents and agreements.

Data of Individual Contractors

In the case of contractors who are natural persons, the Company processes the data identified above within the scope necessary for the performance of the hire-of-work contract or fixed-engagement contract, which may include:

Personal and contact data.
Professional and experience data.
Data in the contract and the scope of work.
Financial data for the payment of remuneration.
Tax identification number.
Data on access to the Company's systems and premises (to the extent rights are granted).

Sensitive personal data

In general, the Company has no purpose of collecting sensitive personal data under Section 26 of the PDPA, however the Company will process only to the extent necessary and under an appropriate lawful basis:

Health data — annual health examinations, insurance claims, assessment of fitness for work.
Disability data — arranging an appropriate working environment and benefits.
Criminal records — background checks prior to employment.
Religious data (to the extent appearing in documents) — the Company will obscure, or refrain from using, such data.
Biometric Data — premises access control (to the extent the Company uses such a system).

4. Purposes and Lawful Bases of Processing

Consideration of applications, selection, and hiring decisions — pre-contractual steps / consent (for sensitive data).
Preparation of the employment contract and onboarding — performance of a contract.
Payment of wages, bonuses, and benefits — performance of a contract / legal obligation.
HR administration — performance of a contract / legitimate interest.
Performance appraisal and development — performance of a contract / legitimate interest.
Management of health, insurance, and safety — performance of a contract / legal obligation / consent (for sensitive data).
Compliance with tax and social security obligations and reporting to government authorities — legal obligation.
Compliance with labour law, such as the Labour Protection Act, the Social Security Act, and tax law — legal obligation.
Management of disciplinary proceedings, complaints, and disputes — legitimate interest / legal obligation.
Premises access control and system security — legitimate interest.
Oversight of the use of the Company's property and systems — legitimate interest / compliance with the Computer Crime Act.
Termination of employment, payment of compensation, and the offboarding process — performance of a contract / legal obligation.
Issuance of employment certificates; reference checks — performance of a contract / consent.
Establishment, exercise, or defence of legal claims — legitimate interest.

5. Data Recipients and External Data Processors

The Company may disclose your personal data to the following persons or categories of persons, to the extent necessary and consistent with the purposes of processing and the lawful bases:

Employees and supervisors of the Company with a need for access on a need-to-know basis — such as Human Resources, Accounting, Legal, and IT.
Affiliated companies (Another Dot Co., Ltd., Robolingo Co., Ltd., eTailligence Co., Ltd.) — for group management and cross-organisational work assignments.
HRIS / Payroll / Time Attendance providers (e.g., Empeo, Peak Account).
Recruitment agencies and headhunters.
Background check service providers.
Health examination providers (hospitals and clinics).
Banks and financial institutions, for salary and benefit transfers.
Life and health insurance companies, for employee insurance benefits.
Provident fund management companies.
Training and personnel development providers.
Professional advisers (legal advisers, auditors, tax advisers).
Government authorities, such as the Social Security Office, the Revenue Department, the Department of Labour Protection and Welfare, the Department of Skill Development, and the Ministry of Labour.
Law enforcement agencies, where there is a lawful order, court warrant, or request from a competent authority.
Counterparties to corporate transactions, in the event of a merger, acquisition, or corporate restructuring.
External assessors (auditors, certification bodies), for assessments against standards for which the Company seeks certification.

6. Cross-Border Transfer of Personal Data

Most processing and storage takes place in the cloud systems of Amazon Web Services and Google located in the Republic of Singapore.

In some cases, data may be transferred to other countries for the provision of services by external data processors, in which case the Company will ensure appropriate protection mechanisms as required by law.

7. Retention of Personal Data

The Company retains your personal data only to the extent necessary, for as long as the data continues to serve a lawful business purpose in relation to the purposes of processing.

When your personal data is no longer used for the above purposes, the Company will delete, destroy, or anonymise your personal data in accordance with its data destruction standards. However, in the event of a dispute, exercise of rights, or legal proceedings concerning your personal data, the Company reserves the right to retain such data until a final order or judgment is received.

8. Data Protection Officer (DPO)

The Company has appointed a Data Protection Officer pursuant to Section 41 of the PDPA to provide advice, monitor compliance with the law, coordinate with the Office of the Personal Data Protection Committee (PDPC), and receive complaints from data subjects.

DPO contact details:

Email: dpo@wisesight.com
Address: 123 Suntowers Building B, 33rd Floor, Unit B3301–3304, Vibhavadi Rangsit Road, Chomphon Sub-district, Chatuchak District, Bangkok 10900
Telephone: 022741299

9. Rights of Data Subjects

Under the PDPA, data subjects have the following rights; the details and procedures for exercising each right appear in the relevant privacy notice:

Right to be informed. The Company will provide a "Privacy Notice" containing clear details of the purposes of processing, together with a "Cookie Policy" setting out the categories of cookie technologies the Company uses and the purposes of using such cookie technologies; and in the event that the Company processes data other than in accordance with those purposes, or outside the scope of any consent given, the Company will notify and/or seek consent from the data subject before processing personal data outside such purposes.
Right to withdraw consent. The data subject may withdraw consent previously given to the Company at any time.
Right of access. The data subject may request access to his or her personal data and a copy of the personal data processing activities, and may request that the Company disclose how such data was obtained.
Right to rectification. The data subject may request the correction of inaccurate personal data so that such data is accurate, up to date, and not misleading.
Right to erasure. The data subject may request that the Company delete or destroy personal data, or render personal data anonymous such that the data subject can no longer be identified.
Right to data portability. Where the Company's data systems support reading or use by generally available automated tools or devices, and the personal data can be used or disclosed by automated means, the data subject may request a copy of his or her personal data, request the automatic transfer of such data to another data controller, and request to receive the personal data so sent or transferred.
Right to restriction of processing. The data subject has the right to request that the Company restrict the use of personal data.
Right to object. The data subject may object to the processing of personal data.

Channels for Exercising Rights

Data subjects may exercise the above rights through the following channels:

Online DSAR form at https://wisesight.com/legal-and-privacy/data-subject-request
Email: dpo@wisesight.com
Written correspondence addressed directly to the DPO at the Company's office address.

10. Complaints and Contact Channels

Internal channel — data subjects may lodge complaints with the Company directly through the DPO via the channels specified.
Government channel — where a data subject is dissatisfied with the Company's handling of a matter, or wishes to lodge a complaint directly with a government authority, the data subject may contact: Office of the Personal Data Protection Committee (PDPC). Address: 7th Floor, Ratthaprasasanabhakti Building, The Government Complex, 120 Moo 3, Chaengwattana Road, Thung Song Hong Sub-district, Lak Si District, Bangkok 10210. Telephone: 02-142-1033. Email: saraban@pdpc.or.th. Website: https://www.pdpc.or.th

11. Review and Amendment

Review — The Company will review this Policy at least once a year, or upon a change in law, in PDPC guidance, or a material change in the business.
Amendment — The Company will announce amendments to employees and affected data subjects through the Company's website and appropriate internal channels.
Effectiveness — Amendments take effect on the date of announcement or the date specified in the announcement, whichever occurs later.