Athentic Consulting Co., Ltd.

Applicant’s Privacy Notice

Latest updated: 1 September 2023

Athentic Consulting Co., Ltd. (“we”, “us” and “our”) processes personal data of applicants (collectively referred to as “Applicant”, “you” and “your”) with the highest standard measures to act in compliance with the Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). You may find the full version of Athentic Consulting Co., Ltd. Applicant’s Privacy Notice (“Privacy Notice”). However, the summary of the Privacy Notice is shown below.

Topic	Overview
What personal data do we process?	We process collected personal data including identity data, employment data, educational data, profile data, financial data, transaction data, address/contact data, reference-persons data, and supporting documents.
How do we use those personal data?	We process personal data according to our purposes and scope, and with the legal bases as explained in our Privacy Notice.
Who do we transfer personal data to?	According to the scope and processing purposes specified in this Privacy Notice, currently, we are not obliged to transfer or disclose your personal data to any third-party organisations.
What are your rights as a data subject?	As a data subject, you are entitled to the data subject rights, including, but not limited to, right of access, right to rectification and right to erasure, as well as other rights as described in this Privacy Notice.
Revision of the Privacy Notice	Any revision made shall be notified to all related parties under this Privacy Notice.

Privacy Notice

1. Purposes and scope of the Privacy Notice

2. Personal data we collect

3. How we collect your personal data

4. How we process your personal data

5. Use of personal data with third-party organisations

6. Transferring of personal data to foreign countries

7. Security measures for personal data protection

8. Personal data retention period

9. Your rights as data subject

10. Privacy notice revision

1. Purposes and scope of the Privacy Notice

This Privacy Notice applies to all our Applicant. In this regard, we act as the data controller under the PDPA. Therefore, we are committed to collect and process Applicant’s personal data in accordance with our purposes and scope as specified herein this Privacy Notice.

Data Controller Contact Information Athentic Consulting Co., Ltd. 15th floor Chamchuri Square Building, 319 Phayathai Rd, Khwaeng Pathum Wan, Khet Pathum Wan, Bangkok 10330 Tel.: 02-853-9258 Email: [email protected]

Data Protection Officer (DPO) Contact Information Tel.: 02-853-9258 Email: [email protected]

As used in this Privacy Notice, the following terms shall have the meanings set forth below:

“process” means any operation performed on Applicant’s personal data, including collection, use, storage, disclosure and deletion of personal data.

“legal bases” means justifiable reasons to process personal data in accordance with Section 24, as well as special conditions to process sensitive data in accordance with Section 26 of the PDPA.

If you provide personal data of third parties, such as family members, emergency contacts, or reference persons, please inform such persons of the information described in this Privacy Notice. Also, in some cases, you may need to obtain consent from the individuals in order for us to process their personal data.

This Privacy Notice may be revised at any given time as shall be notified to Applicant through appropriate channels.

2. Personal data we collect

We collect the following groups of your personal data;

• identity data such as first name-surname, nickname, and signature;

• employment data such as working position, work experience, and reason of resignation;

• educational data such as language knowledge level, examination result, cover letter;

• address/contact data such as address, mobile number, and email;

• financial data such as income;

• profile data such as nationality, age, and date of birth;

• transaction data such as, date of application;

• reference-persons data such as; full name of the referee, referee’s occupation, referee’s address and contacting data; and

• supporting documents such as copy of identification card, copy of transcript, copy of diploma.

3. How we collect your personal data

In general, we will directly collect your personal data through these processes or channels, including, but not limited to;

• when directly receive documents from you via e-mail, our website, and handed directly papers;

• when directly contact you via phone, or in person meeting;

However, we may collect additional personal data through third-party organisations which include;

• the job recruitment website such as, Linkedin, and JobsDB

4. How We Process Your Personal Data

We process your personal data to carry out tasks per our scope and purposes of providing groups of activities.

Group of Activities	Group of PIIs	Legal Bases
Job recruitment [ROP ID: JR-001]	Identity data Employment data Educational data Profile data Financial data Transaction data Address/contact data Reference-persons data Supporting documents	Contract

We will process your personal data according to the stated purposes and scope. If there came upon a case where your personal data were to be processed for other purposes that cannot be justified by any other legal bases, we would inform you and ask for your consent to process personal data on such uses.

In addition, we would like to inform you that in cases where the processing of your personal data is carried out for compliance with legal obligation or contractual necessity or is necessary for the performance of a contract, not providing such personal data may not allow us to fulfill the objectives mentioned above.

5. Use of personal data with third-party organisations

According to the scope and processing purposes specified in this Privacy Notice, currently, we are not obliged to transfer or disclose your personal data to any third-party organisations.

For the cases where personal data are being disclosed or transferred to third-party organisations, we will ensure that the minimum amount of personal data are being disclosed or transferred, and may consider anonymization and psuedonnymisation techniques for greater security. Further, the third-party organisations who will process your personal data for us will be required to have in place appropriate privacy policy. We do not permit these third-party organisations to use your personal data in a way that diverge from the agreed scope and purposes.

6. Transferring of personal data to foreign countries

According to the scope and processing purposes specified in this Privacy Notice, we do not pass on personal data to any data recipients in foreign countries.

In this regard, we shall pass on your personal data to foreign countries only when any of these requirements have been met;

• the recipient country has adequate personal data protection standards as specified by the Personal Data Committee;
• the foreign organisation has in place a comprehensive privacy policy which has been examined and certified by the Personal Data Committee;
• the foreign organisation is obligated to follow a substantial privacy policy with enforceable data subject's rights, and effective legal remedies as per the rules and methods specified by the Personal Data Protection Committee, including, but not limited to, standard contractual clauses and code of conduct;
• a pre-requisite to the exercise of legal rights;
• consent has given where you are well-aware of the inadequate personal data protection standards of the recipient countries or international organisations;
• a requirement for the execution of an agreement to which you are a party of, or the fulfillment of a request you made prior to entering into the agreement;
• a necessary task to carry out under a contractual obligation between Athentic Consulting Co., Ltd. and other persons or entities for your interests;
• to prevent or limit danger to life, body or health of individual who is unable to give consent at the time; and
• a necessary task carried out in the public interest.

7. Security measures for personal data protection

We have implemented certain security measures to ensure the security of your personal data. In this connection, third-party organisations which process personal data on our behalf are required to ensure the security of your personal data, and to carry out the processing in accordance with our security policy:

• controlling the accessing of personal data, and prime components of an information system, which under the consideration of need-to-know basis in accordance of principle of least privilege.
• administering user access management.
• defining user’s responsibilities in order to prevent unauthorized access, misuse, modification, alteration, deletion, or disclosure of personal data without proper authorization.
• Implementing the audit trail to allow recording of accession, modification, alteration, or deletion of personal data.

8. Personal data retention period

We will store your personal data for as long as necessary to fulfill our job recruitment purpose. According to the stated purpose, your personal data will be securely deleted within 6 months after you are not selected for the applied position. How ever, in case you are selected to the applied position, please find more details on our Personnel’s Privacy Policy.

9. Your rights as data subject

Under the PDPA, you are entitled to the following rights:

• right of access – you have the right to request for a copy of your personal data and examine whether we have processed your personal data in lawful manner;
• right to data portability – for the case where we have in place an automated platform allowing you to access your personal data automatically:
  • you may request that your personal data be transferred automatically to other organisations, or
  • you may request for your personal data in such a format that has been transferred to other organisations, except for the case where there is a technological limitation;
• right to object – you have the right to object to the processing which concern the following legal bases or processing purposes:
  • public task or legitimate interest, and
  • scientific, historical or statistical studies, unless a necessary task to be carried out in the public interest;
• right to erasure – you have the right to request for personal data deletion or anonymization according to the following cases:
  • when the processing of personal data is no longer necessary,
  • when consent has been withheld, and we cannot rely on other legal bases to process your personal data,
  • when there is objection raised against the processing, and
  • when your personal data have been processed in unlawful manner;
• right to restrict processing – you have the right to restrict the processing according to the following cases:
  • during verification of your request to rectify your personal data,
  • when personal data were to be deleted or destroyed, but was followed by your request for processing restriction instead,
  • when processing terms have passed, but you have requested for processing restriction in order to establish legal claims, be compliance with, exercise or object legal claims, and
  • during verification of your request to object the processing; and
• right to rectification – in order to keep your personal data correct and concurrent to the present, you have the right to request for rectification of your personal data.

In some circumstances, we may not be able to carry out and support exercise of your rights, including, but not limited to, the cases where a legal process is taking place or where we are required to oblige with the court order.

However, where you have given consent to process personal data, you will continue to have the right to retract your consent by contacting relevant departments. We will therefore be required to terminate such processing as soon as possible. However, the retraction only applies to the processing carried out thereafter. Any processing carried out before the retraction will not be reversed.

Please be informed that we do record all requests to ensure all issues are resolved. For any queries regarding your personal data protection and rights, more details are available at:
Thailand Data Protection Guidelines 3.0

In the case where you intend to exercise your rights, or to file complaint against your personal data processing, please contact our DPO (contact details have been provided above). We will process your request in a secure and timely manner as required by the laws. Also, in the case that we refuse to comply with your request, you can file complaint to the Office of the Personal Data Protection Commission (“PDPC”) via [email protected] using the complaint form provided by the PDPC.

10. Privacy notice revision

This Privacy Notice applies to our Applicant, and was last updated on 1 September 2023. We hold the rights to review and edit this Privacy Notice as we see appropriate. Any revision made shall be notified to all related parties under this Privacy Notice.