Privacy Notice

Privacy Notice

Last Updated: 19 May 2021

Dear Candidates,
Worldlease Company Limited ("Company") values a privacy and strives for protecting your personal data (“Personal Data”) based on the laws of Thailand. You are applying for a job with the Company who is the “Data Controller” according to the Personal Data Protection Act B.E. 2562 (2019) for the collection, use, and/or disclosure of your Personal Data during and for the purposes of a recruitment process.
This Privacy Notice explains: -

What kind of Personal Data does the Company collect? This includes what you tell the Company about yourself (“you”, “your” or “yourself”) and what the Company learns through a recruitment process.
How does the Company use your Personal Data?
Who does the Company disclose the Personal Data to?
What are the choices the Company offer, including how to access and update your Personal Data?
What are your privacy rights and how does the law protect you?

1.Collection of Personal Data

The Company collects many different kinds of the Personal Data, depending on various circumstances that are relevant to recruitment process.
The Company collects the Personal Data about you from a variety of sources, including but not limited to: -

From you directly during the recruitment process (e.g., application forms online/offline or otherwise, CVs or resumes etc.);

The information the Company has received during recruitment process regardless of format, including face-to-face interview, telephone or video call;
Identification documents such as ID card, passport, driving license, military service certificate or any other documents issued by government agencies, etc.;
The information the Company has received when you use the Company’s systems, tools and websites;
Other forms completed by you at during the recruitment process; and/or
The correspondences with you through interviews, meetings or other assessments e.g., CCTV, recording equipment, etc.

In some instances, the Company may collect the Personal Data about you from third parties or publicly available sources, such as the references supplied by your former employers (e.g., period of previous employments, performance during previous employment, etc.), data from third parties e.g., LinkedIn, JobsDB, Facebook, etc., data from employment background check providers, credit bureau and data from criminal record.
The categories of Personal Data about you that the Company collects, subject to the applicable law, include but not limited to: -

Personal details: Name(s), last name, gender, date of birth, marital status, personal identification number, passport number, other government issued identification number(s) or documents issued by the government agencies for verification purposes, tax identification number, nationality, image of ID card, passport, or driving license, signatures, authentication data, information provided by you as an answer to the Company’s authentication question (e.g., passwords, facial and voice recognition data, etc.) photographs, and CCTV images;
Family details: Names and contact details of family members and dependents;
Contact details: Address, telephone number, email address and social media profile details;
Education history: The details of educational background, transcript, educational achievements and other additional courses;
Professional details: The details of profession, professional memberships, former employer’s feedback, professional qualifications, skills, experience, trainings and employment history;
Transactional details: The details of your salary and benefits (such as bonus and insurance coverage);
Other details: The information may be received from the interview; and
Sensitive Personal Data: The Personal Data that the law specifically prescribes, including information about your race, ethnic origin, political opinions, religion or philosophical beliefs, sexual behavior, criminal records, health data, disability, labour union membership, genetic or biometric data or any other information which affects you in the same way as announced by the Personal Data Protection Committee.

During the recruitment process, the Company may also collect some Sensitive Personal Data e.g. your criminal record or information relating to health about you to ensure that you are permitted to undertake the role you applied for and to assess and evaluate that you are suitable for employment in the role you applied for and, to ensure that the Company complies with regulatory obligations placed on the Company with regard to the Company’s hiring. The Company will not collect, use and/or disclose this type of Personal Data without your consent unless the law allows the Company to do so.

2.Use of Personal Data

The Company may collect and use your Personal Data only if the Company have proper reasons to do so. This includes sharing it outside the Company.
The Company will rely on one or more of the following lawful grounds when collecting, using and/or disclosing your Personal Data: -

When it is to fulfil a contract the Company has or will enter into with you (contractual basis) – that is when the Company needs your Personal Data to deliver a contractual service to you or before entering into a contract with you;
When it is the Company’s legal obligation (legal obligation) – that is when the Company needs to collect, use and/or disclose your Personal Data to comply with the law or statutory obligation;
When it is in the Company’s legitimate interest (legitimate interest) – that is when the Company collects, uses and/or discloses your Personal Data for the Company’s legitimate interest as permitted under the law, so long as your fundamental rights are not overridden by the Company’s legitimate interest; and/or
When you consent to it (consent) – that is when you allow the Company to collect, use and/or disclose your Personal Data for certain purposes.

The Personal Data Protection Act B.E. 2562 (2019) considers some personal data to be more sensitive and therefore treats this type of Personal Data more stringently. In this regard, the Company will not collect, use and/or disclose this type of Personal Data without your consent unless the law allows the Company to do so. If the Company will collect, use, and/or disclose such sensitive Personal Data, it will only do so upon your consent or only for one of the following purposes: -

for the prevention or suppression of danger to life (vital interest);
for the compliance with a law to achieve the purposes with respect to employment protection;
for establishing, compliance, exercising and/or defending legal claims.

The purposes for which the Company may collect, use and/or disclose your Personal Data, subject to the applicable law, and legal basis on which the Company may perform such collection, use and/or disclose, are : -

Purposes of data collection, use and/or disclosure

Lawful basis for collection, use and/or disclosure

Recruitment Process

to process your application
to verify your identity
to assess your skills, qualifications, and suitability for the role
to carry out background and reference checks, where applicable
to communicate with you about the recruitment process and other matters as per your request
to keep records related to the Company’s hiring process.
To comply with regulatory requirements

Contractual basis
Legal obligation
Consents
Legitimate interest

Whether the Company will consider selecting you to perform in any position or not is considered to be the collection, use, and/or disclosure of Personal Data under the Company’s legitimate interests. Since, such collection, use, and/or disclosure is for the benefit of the Company in appointing a suitable candidate to each role, the Company, therefore needs to collect, use and/or disclose your Personal Data to decide whether to enter into a contract with you or not.
The collection, use, and/or disclose of Personal Data may potentially include your sensitive Personal Data. The sensitive Personal Data is not routinely collected from all candidates, it may be collected where the Company has legal obligations or consents from you to do so, or if you choose to disclose it to the Company during the period of your relationship with the Company.
The Company may collect your CV and the results from any tests you took to decide whether you meet the basic requirements to be shortlisted for the role in question. If you do, the Company will decide whether your application is suitable to invite you for the interview. If the Company decides to call you for the interview, the Company will use the data you provide to the Company at the interview to decide whether to offer you the role. If the Company decides to offer you the role, the Company may then take up the references and/or any other checks before confirming your appointment.

If you fail to provide your Personal Data to the Company
Where the Company is required by law to collect your Personal Data or need to collect your Personal Data under the terms of contract that the Company has with you and you fail to provide your Personal Data when requested, the Company may not be able to perform obligation under the contract the Company has with you or plans to enter into with you (for example, to process your job application). In this case, the Company may have to decline to process your job application, but the Company will notify you if this is the case at the time your Personal Data is collected.

3. Disclosure of Personal Data
The Company may share your Personal Data internally with the followings: -

The Company’s employees who would have a managerial responsibility for you or are acting on their behalf;
The Company’s employees who have the responsibility for recruitment processes or who works in Human Resource and/or employees assigned to undertake the recruitment process (e.g., recruitment, assessment, pre-employment screening, etc.);
The Company’s employees in the recruitment business unit and/or employees assigned to undertake the recruitment process who will assess and consider you for the interview;
The Company’s employees in the regulatory compliance unit with the responsibility to investigate the issues of non-compliance with laws and regulations, policies and contractual requirements;
The Company’s employees in IT department and system owners who manage user access;
Audit and investigations employees in relation to specific audits/investigations; and/or
Security personnel and receptionists of the Company who are stationed and operating at the Company’s facilities/premises.

The Company may also need to share your Personal Data with certain external third parties including:

your referees;
recruitment agency;
academic institutions (e.g., universities, colleges, etc.) in validating the data you have provided to the Company;
suppliers who provide services on the Company’s behalf; and/or
suppliers who undertake a background screening on the Company’s behalf and related government authorities (e.g., criminal record, background check, etc.).

Except as described in this Privacy Notice, the Company will not use the Personal Data for any purposes other than the purposes as described to you in this Privacy Notice. Should the Company intend to collect, use or transfer additional information which are not described in this Privacy Notice, the Company will notify you and obtain your consent prior to the collection, use and/or disclosure unless the Company is permitted to do so without your consent under the law. You will also be given the opportunity to consent or to decline approval of such collection, use and/or transfer of your Personal Data.
The Company will continue to adhere to this Privacy Notice with respect to the information the Company has in its possession relating to prospective, existing and former candidates.

Your Personal Data may be transferred to and collected and/or used in other countries, including Malaysia.
However, such countries may not have the same level of protection for the Personal Data as Thailand. In the event that the Company does this, the Company shall ensure that such countries have an appropriate level of Personal Data protection measures or that the transfer is lawful. For example, your Personal Data may be shared to other CIMB group companies in accordance with the Company’s Binding Corporate Rules (BCRs) or other relevant contractual arrangements, which require all CIMB group companies to follow the same rules or terms when collecting, using and/or disclosing your Personal Data. If you wish to request for a copy of the BCRs, you can do so by contacting the Company at dpo@worldlease.co.th

The Company may need to transfer the Personal Data in this way to carry out the Company’s contract with you, fulfill the legal obligations, protect the public interests and/or for the Company’s legitimate interests. In some countries, the law might compel the Company to share certain Personal Data e.g., with tax authorities. Even in these cases, the Company will only share the Personal Data with people who have the right to see it.

4. Retention of Personal Data
The Company will only retain your Personal Data for as long as it is necessary to carry out the purpose for which it was collected only, that is., for the recruitment, employment and legal reasons, or compliance with the applicable laws.

The Company will keep your Personal Data for the duration of your recruitment and for a period of 3 years from the date the process of recruitment ends. However, in the event of regulatory or technical reasons, the Company may keep your Personal Data for longer than the recruitment period. If the Company does not need to retain the Personal Data for longer than it is legally necessary, the Company will destroy, delete or anonymize it (so that it can no longer be associated with you)

5. Accuracy of your Personal Data
The Company needs your help to ensure that your Personal Data is current, complete and accurate. Please inform the Company of any changes to your Personal Data by: -

Contacting the Company’s HR representative at hr.recruitment@cimbthai.com; or
updating your information at/via Taleo Recruitment System.

The Company will occasionally request the updates from you to ensure the Personal Data the Company uses to fulfill the purposes of collection, use and/or disclosure are current, accurate and complete.

6. Your rights as data subject
Under certain circumstances, you have rights under data protection law in relation to your Personal Data. It is the Company’s policy to respect your rights and the Company will act promptly and in accordance with any applicable law, rule or regulation relating to the collection, use and/or disclosure of your information.
Details of your rights are set out below: -

Right to withdraw consent: When the Company collects, uses and/or discloses your Personal Data under your consent, this right enables you to withdraw your consent to the Company’s collection, use and/or disclosure of your Personal Data, which you can do at any time. The Company may continue to collect, use and/or disclose your Personal Data if the Company has another legitimate reason to do so.
Right to access: This enables you to receive a copy of your Personal Data from the Company.
Right to correct: This enables you to have any inaccurate, outdated and/or incomplete Personal Data corrected. Please see above in 5. (Accuracy of your Personal Data) for detail of how you can request to have your Personal Data corrected.
Right to erasure: This enables you to ask the Company to delete, destroy or anonymize your Personal Data where there is no good reason for the Company to continue collecting, using and/or disclosing it. You also have the right to ask the Company to delete your Personal Data where you have exercised your right to object to collection, use and/or disclosure (see below). This is not a blanket right to require all Personal Data to be deleted. The Company will consider each request carefully in accordance with the requirements of any laws relating to the collection, use and/or disclosure of your Personal Data.
Right to object: This enables you to object to the collection, use and/or disclosure of your Personal Data where the Company is relying on the legitimate interest. You also have the right to object where the Company is collecting, using and/or disclosing your Personal Data for direct marketing purposes and profiling activities.
Right to restrict collection, use and/or disclosure: This enables you to ask the Company to suspend the collection, use and/or disclosure of your Personal Data, for example, if you want the Company to establish its accuracy or the reason for collecting, using and/or disclosing it.
Right to portability: In certain circumstances, you can request to receive a copy of your Personal Data in a commonly used electronic format. This right only applies to your Personal Data that you have provided to the Company. The right to data portability only applies if the collection, use and/or disclosure is based on your consent or if the Personal Data must be collected, used and/or disclosed for the performance of obligation under a contract.
Right to lodge a complaint: This enables you to file the complaint with a related government authority, including but not limited to, the Thailand Personal Data Protection Committee in the case where, in your view, the Company, the Company’s employee or contractor violates or fails to comply with the Personal Data Protection Act of Thailand B.E. 2562 (2019) or notifications issued thereunder.

You may exercise any of your rights at any time using the contact details set out in 10. (Contact us) below. You will not have to pay a fee to access your information (or to exercise any of the other rights). However, the Company may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, the Company may refuse to comply with your request in these circumstances.
The Company may need to request specific information from you to help the Company confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that your Personal Data is not disclosed to any person who has no right to receive it. The Company may also contact you to ask you for further information in relation to your request to speed up the Company’s response.
The Company tries to respond to all legitimate requests within 30 days. Occasionally, it may take the Company longer than 30 days if your request is particularly complex or you have made a number of requests. In this case, the Company will notify you and keep you updated.

Handling of complaints
In the event that you wish to make the complaint about how the Company collects, uses and/or discloses your Personal Data, please contact the Company at hr.recruitment@cimbthai.com and the Company will try to consider your request as soon as possible. This does not prejudice your right to file the complaint with a government authority or the Personal Data Protection Committee.

7. Security of your Personal Data
Information is the Company’s asset and therefore the Company places a great importance on ensuring the security of your Personal Data. The Company regularly reviews and implements up-to-date physical, technical and organizational security measures when collecting, using and/or disclosing your Personal Data. The Company has internal policies and controls in place to ensure that your Personal Data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by the Company’s employees in the performance of their duties. The Company’s employees are trained to handle the Personal Data securely and with utmost respect, failing which they may be subject to a disciplinary action.

8. Your responsibilities
You are responsible for making sure that the Personal Data you give the Company or provided on your behalf, is accurate and up to date, and you must tell the Company as soon as possible if there are any updates.

When you have entered into an employment contract with the Company. You will have some responsibilities under your employment contract to provide the Company with the Personal Data in order to exercise your statutory rights. Failing to provide the Personal Data may mean that you are unable to exercise your statutory rights.

Certain Personal Data, such as contact details, and payment details, must be provided to the Company in order to enable the Company to enter into the contract of employment with you. If you do not provide such Personal Data, this will hinder the Company’s ability to administer the rights and obligations arising as a result of employment relationship efficiently.

9. Revision of the Company’s Privacy Notice
The Company keeps the Privacy Notice under a regular review and thus the Privacy Notice may be subject to change. The date of the last revision of the Privacy Notice can be found on the top of the page.

10. Contact us
If you have any questions in regard to the protection of your Personal Data or if you wish to exercise your rights, please contact: -

Data Protection Officer: E-mail dpo@worldlease.co.th ; or
Contacting the Company’s HR representative: Talent Acquisition at hr.recruitment@cimbthai.com

Remark: This Privacy Notice shall be effective on the date on which the relevant provisions of Personal Data Protection Act B.E 2562 (2019) (as amended) becomes effective against the Company.