{"id":3675,"date":"2026-02-23T23:42:39","date_gmt":"2026-02-23T16:42:39","guid":{"rendered":"https:\/\/www.yipintsoinext.com\/?page_id=3675"},"modified":"2026-03-08T22:29:08","modified_gmt":"2026-03-08T15:29:08","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/www.yipintsoinext.com\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Privacy Policy<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Employee Personal Data Protection Policy (Internal Use). This Policy is established for internal use within the Company to govern the collection, use, disclosure, or other processing of employees\u2019 personal data. It also sets out guidelines for employees of the Company who are required to perform any actions involving personal data in the course of their duties.<\/p>


Goal<\/b><\/b><\/p>

Following the enactment of the Personal Data Protection Act B.E. 2562 (2019), which came into effect on June 1, 2022, the Company places great importance on compliance with applicable laws, including the protection of employees\u2019 personal data. To ensure that the collection, use, disclosure, and retention of employees\u2019 personal data are carried out in accordance with the requirements of the aforementioned law, the Company has established this Employee Privacy Policy for Internal Use. This Policy applies to any processing of employees\u2019 personal data within the Company and serves as a guideline for employees who are required to handle or process personal data in the course of their duties.<\/p>


2. Scope of the Policy and Practice Guidelines<\/b><\/b><\/p>

This Policy and its guidelines are established to set out the Company\u2019s framework for handling employees\u2019 personal data. It also provides guidance for employees who have duties, responsibilities, or assignments involving the handling or processing of personal data as a result of the enforcement of the Personal Data Protection Act B.E. 2562 (2019). Under this Policy, the Company may act as either a Data Controller or a Data Processor, as defined under the law, depending on the circumstances.<\/p>


3. Definitions<\/b><\/b><\/p>

Personal Data means any information relating to an identified or identifiable natural person (\"Data Subject\"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.<\/p>

Sensitive Data means Personal Data pertaining to racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or any data which may affect the Data Subject in the same manner, as prescribed by the Committee.<\/p>

\u2013 Data Subject means a natural person who is the owner of the Personal Data.<\/p>

- Data Controller means a person or a legal entity that has the authority and responsibility to make decisions regarding the collection, use, or disclosure of personal data.<\/p>

\u2013 Data Processor means a Person or a legal entity that operates in relation to the collection, use, or disclosure of Personal Data pursuant to the orders given by or on behalf of a Data Controller, where such Person or legal entity is not the Data Controller.<\/p>

\u2013 The Office means the Office of the Personal Data Protection Commission.<\/p>

\u2013 The Committee means the Personal Data Protection Committee.<\/p>

\u2013 The Company means YIPINTSOI NEXT COMPANY LIMITED and its affiliates.<\/p>

\u2013 Employee means any individual whom the Company has agreed to employ under an employment agreement, regardless of the title or designation used.<\/p>


4. Key Elements of the Employee Personal Data Protection Policy<\/b><\/b><\/p>

4.1 The Company regards the protection of personal data as a matter of utmost importance, including the personal data of its employees.<\/p>

4.2 Accordingly, the Company will collect, use, or disclose employees\u2019 personal data only to the extent necessary for administrative purposes or for lawful purposes. Such purposes include, but are not limited to, the following:<\/p>

For human resource management, employee welfare, and occupational health administration.<\/p>

\u2013 For use in bidding, proposals, or submissions to clients, or for conducting the Company\u2019s business in accordance with its business objectives.<\/p>

For marketing activities or corporate public relations where it may be necessary to present information relating to employees.<\/p>

\u2013 For submission or disclosure to government authorities as required by applicable laws or as requested or ordered by competent government officials, such as tax submissions to the Thai Revenue Department.<\/p>

If it becomes necessary to collect personal employee data beyond the purposes specified above, the Company will notify employees and obtain additional consent on a case-by-case basis.<\/p>

4.3. The Company may Collect, Use, or Disclose Personal Data solely in accordance with the specified purposes.<\/p>

4.4. The Company shall clearly define the duties of data collectors, data processors, data custodians, data users, and approvers of data use, including verification procedures, to ensure that Personal Data is securely maintained and utilized in good faith.<\/p>

4.5. The Company may Collect, Use, or Disclose Personal Data only upon receiving explicit written consent or consent via electronic means from the Data Subject.<\/p>

4.6. The Company may Collect, Use, or Disclose Personal Data without obtaining consent from the Data Subject in the following cases:<\/p>

\u00a0 To prevent or suppress a danger to a person's life, body, or health.<\/p>

\u00a0 2) It is necessary for the performance of a contract, such as an employment contract.<\/p>

\u00a0 3) It is necessary for the legitimate interests of the Company, such as CCTV recordings.<\/p>

\u00a0 4) It is for compliance with applicable laws for the Company, such as submitting data to the Revenue Department or complying with labor protection laws.<\/p>

4.7. The Company shall not Collect, Use, or Disclose Sensitive Data of Employees, except in the following cases:<\/p>

\u00a0 1) Explicit consent is obtained in writing or via electronic means from the data subject.<\/p>

\u00a0 2) To prevent or suppress a danger to life, body, or health of the Person, where the Data Subject is incapable of giving consent for any reason.<\/p>

\u00a0 3) This is information that is disclosed to the public with the explicit consent of the Data Subject.<\/p>

\u00a0 4) It is necessary for the establishment, compliance, exercise, or defense of legal claims.<\/p>

\u00a0 5) It is necessary to comply with a law, labor protection, social security, or other related matters.<\/p>

4.8. The Employee, as the Data Subject, has the right to easily view, verify, and access their Personal Data, including requesting a copy of their Personal Data retained at any time, and has the duty to provide additional information in the event of changes to Personal Data or to submit information in the event that relevant organizations or agencies request further information.<\/p>

4.9. The Company shall notify the Data Subject of the following information prior to the Collection of Personal Data:<\/p>

\u00a0 1) The purpose for the collection, use, or disclosure of personal data. If the Company alters such purpose, the Company must notify the Data Subject and obtain consent again.<\/p>

\u00a0 The retention period throughout the duration of the Company's employment, and the retention of Personal Data of former Employees from the date the employment relationship between the Employee and the Company terminates for a period not exceeding 10 years, in accordance with the duration prescribed by relevant laws, taking into account the statutory prescription period for legal proceedings that may arise from or relate to the documents or Personal Data collected by the Company. Upon the expiration of such retention period, the Company shall delete, destroy, or anonymize the Personal Data so that it can no longer identify the Data Subject.<\/p>

\u00a0 3) The categories of persons or entities to whom the personal data collected by the organization may be disclosed.<\/p>

\u00a0 4) Information concerning the organization\u2019s contact channels, methods, and locations.<\/p>

\u00a0 5) The rights of the Data Subject under the Personal Data Protection Act B.E. 2562 (2019).<\/p>

\u00a0 6) If you are required to provide Personal Data to comply with a law or contract, or if it is necessary to provide Personal Data for the purpose of entering into a contract, you will be notified accordingly, including the potential consequences of failing to provide such Personal Data.<\/p>

The Company shall not collect Personal Data from sources other than directly from the Employee who is the Data Subject. The Company shall maintain a clear policy prohibiting relevant Employees or those assigned to handle Employee Personal Data, such as the Human Resources Department, from collecting Personal Data from sources other than the Data Subject. Should Personal Data be obtained from another source, the Company shall notify the Data Subject within 30 days and obtain consent from the Data Subject.<\/p>

4.11. The Company shall ensure that the Collected Personal Data remains accurate, up-to-date, complete, and not misleading.<\/p>

4.12. The Company shall comply with lawful requests from the Data Subject, which comprise:<\/p>

\u00a0 1) Request to access the Data Subject\u2019s Personal Data.<\/p>

\u00a0 Request for a copy of the Data Subject's Personal Data.<\/p>

\u00a0 Request to restrict the use of the Data Subject's Personal Data.<\/p>

\u00a0 4) Request to delete or destroy the Data Subject's Personal Data.<\/p>

\u00a0 Request to disclose the acquisition of the Data Subject's Personal Data obtained without their consent.<\/p>

\u00a0 6) Request to send or transfer the Data Subject\u2019s Personal Data to another Data Controller, or alteration of the Data.<\/p>

\u00a0 7) Withdrawal of consent for the Collection, Use, or Disclosure of your Personal Data.<\/p>

\u00a0 8) Request to ensure that the Personal Data is accurate, up-to-date, complete, and not misleading.<\/p>

4.13. The Company may reject the Data Subject\u2019s request when there is a necessary ground, such as potential impact on the Personal Data of others, by recording the rejection of the request along with the reasons.<\/p>

4.14. The Company shall implement appropriate security measures to protect Personal Data, not lower than the standards prescribed by law, to prevent the unauthorized or unlawful loss, access, use, alteration, correction, or disclosure of Personal Data.<\/p>

4.15. The Company shall arrange for the retention and use of Personal Data in a strict and confidential manner.<\/p>

4.16. The Company shall arrange for a review of security measures when necessary or when technology changes.<\/p>

4.17. The Company shall arrange for regular audits of the collection, use, disclosure, deletion, or destruction of Personal Data to ensure continued compliance with the organization's policies and the law.<\/p>

4.18. In the event that an external Person or agency wishes to access any Personal Data of an Employee, a written request specifying the necessity and reasons must be submitted to the Data Controller for prior approval. Disclosure or provision is prohibited without such approval.<\/p>

4.19. In the event that a government agency requests an Employee's Personal Data, the Data Controller shall be notified for consideration or review prior to submission, except for routine submissions prescribed by law, such as to the Social Security Office, the Revenue Department, or the Department of Labor Protection and Welfare, which may be submitted immediately and recorded for auditing purposes.<\/p>

4.20. In the event that it is necessary to transfer employee personal data abroad, an executive at the Vice President level or higher shall be the approver and shall proceed strictly in accordance with the law, solely for the purposes specified in Clauses 4.2 and 4.7(1).<\/p>

4.21. The Employee Personal Data retained by the Company shall be treated as the Company\u2019s own property. No Person shall infringe, disclose, access, utilize for personal benefit, or destroy it without approval from the Person assigned by the Company. Violators shall be subjected to the maximum penalty and\/or prosecuted to the fullest extent of the law, including being liable to compensate in full for the damages incurred at the rate prescribed by law.<\/p>

4.22. The retention, maintenance, use, auditing, review, approval, or any other actions regarding Personal Data under this policy shall be kept confidential as necessary and in good faith. General Personal Data of Employees shall be deemed for Internal Use, and Sensitive Data of Employees shall be deemed Confidential.<\/p>

4.23. The Company shall notify the Office of any Personal Data breach within 72 hours of becoming aware of it, unless such breach poses no risk to the rights and freedoms of the Data Subject (if such breach occurs).<\/p>

4.24. In the event of a high risk to rights and freedoms, the organization must notify the Data Subject of the breach and provide information on the measures taken to address it.<\/p>

4.25. The Company shall prepare and maintain a record of at least the following items for inspection by the Data Subject and the Office:<\/p>

\u00a0 The Collected Personal Data.<\/p>

\u00a0 2) The purpose for which each category of Personal Data is collected.<\/p>

\u00a0 3) Information regarding the Data Controller.<\/p>

\u00a0 4) The retention period of the personal data.<\/p>

\u00a0 5) Rights and methods to access Personal Data, including conditions for persons entitled to access Personal Data and conditions for such access.<\/p>

\u00a0 6) The Use or Disclosure of Personal Data.<\/p>

\u00a0 7) The denial of requests or objections.<\/p>

\u00a0 8) Explanations regarding security measures.<\/p>

4.26. The Company shall prepare and maintain a Record of Processing Activities regarding Personal Data as prescribed by the Committee.<\/p>

4.27. The Company shall comply with the legal principles governing personal data protection of Thailand.<\/p>


5. List of Employee Personal Data Necessary for Administration<\/b><\/b><\/p>

In order for any administration of the Company related to Employee Personal Data to operate efficiently, timely, and in good faith, the organization reserves the right to request any additional Personal Data of the Employee at any time during employment.<\/p>

5.1 Any Personal Data provided in the job application and supporting documents as specified by the Company will be considered necessary information for the Company to assign tasks that align with each Employee's knowledge, abilities, experience, and personal qualifications. The list of Personal Data and the reasons for its necessity will be in accordance with the documents specified by the Company.<\/p>

5.2 Personal Data that the Company has the right to additionally request during employment, such as:<\/p>

\u00a0 1) Marital status, names of spouse, and children for the provision of additional welfare or for calculating tax deductions.<\/p>

\u00a0 2) Medical certificates, health examination results, or documents concerning medication, medical supplies, or any other equipment related to medical treatment. The Company will use these in good faith strictly in the following cases:<\/p>

\u00a0\u00a0\u00a0 To provide assistance and prompt, correct treatment.<\/p>

\u00a0\u00a0\u00a0 \u2013 To consider assigning or altering work assignments to suit health conditions.<\/p>

\u00a0\u00a0\u00a0 \u2013 To prevent an outbreak to colleagues or the public.<\/p>

\u00a0 3) Maps, photographs, or other information concerning the residence for considering visits during illness, maternity visits, or providing assistance for other hardships, including building good relationships with the employee\u2019s family.<\/p>

\u00a0 4) Registration of cars and motorcycles to authorize access to the Company\u2019s premises or to arrange safe and adequate parking spaces.<\/p>

\u00a0 5) Any other Personal Data that the organization deems necessary for administration or as required by law for the Company to collect in the future.<\/p>


6. References<\/b><\/b><\/p>

Personal Data Protection Act B.E. 2562 (2019)<\/p>

\u2013 Notification of the Ministry of Digital Economy and Society Regarding Personal Data Security Standards B.E. 2563 (2020)<\/p>

\u2013 Guidelines for the Protection of Personal Data for Employees for Internal Use<\/p>

In the event of any processing of Employee Personal Data within the Company, and to serve as a guideline for Company Employees who have duties regarding Personal Data:<\/p>

To ensure that all Company Employees prioritize compliance with the Employee Privacy Policy, or in the event that Company Employees have duties to take any action regarding Personal Data in accordance with the provisions prescribed by the Personal Data Protection Act B.E. 2562 (2019), the Company<\/p>

has therefore established guidelines and requests all Employees to adopt them as an operational framework as follows:<\/p>

Employees must comply with this policy if they are assigned duties to collect, use, or disclose personal data, or if they take any actions concerning personal data.<\/p>

2. Standard contract forms or forms provided by the Company shall be strictly used when proceeding under Clause 1.<\/p>

3. Employees shall systematically report or notify any Data Breach through the chain of command to the Data Protection Officer (DPO) or the Personal Data Protection Committee established by the Company to serve as a central unit for all policy-level operations. This is to ensure that the Company and its Employees prioritize compliance with the Company's personal data protection policies or guidelines, in alignment with and in accordance with the provisions stipulated in the Personal Data Protection Act.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

Privacy Policy Employee Personal Data Protection Policy (Internal Use). This Policy is established for internal use within the Company to govern the collection, use, disclosure, or other processing of employees\u2019 personal data. It also sets out guidelines for employees of the Company who are required to perform any actions involving personal data in the course […]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-3675","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/pages\/3675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/comments?post=3675"}],"version-history":[{"count":28,"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/pages\/3675\/revisions"}],"predecessor-version":[{"id":4591,"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/pages\/3675\/revisions\/4591"}],"wp:attachment":[{"href":"https:\/\/www.yipintsoinext.com\/en\/wp-json\/wp\/v2\/media?parent=3675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}