Privacy Notice For Whistleblowing Case Management of PTTEP Group
________As PTT Exploration and Production Public Company Limited, or PTTEP, and PTTEP's subsidiaries (hereinafter referred to as the "Company") are well-aware of the importance of Personal Data protection, this Privacy Notice for Whistleblowing Case Management of PTTEP Group was prepared to explain how the Company treats the Personal data of the data subject such as the collection, store, use, disclosure, as well as the rights of the data subject. To inform the data subject of the Privacy Notice of the Company, the Company announces the following.
Scope of “Personal Data”________“Personal Data” means any information relating to a person, which enables the identification of such person, whether directly or indirectly, but not including the information of a deceased person in particular.
Sources of Personal Data________In case you want to reveal your identity to complaint the Company, the Company will directly collect your Personal Data from you when you inform the relevant information.
Personal Data Collected, Used, Disclosed, and/or Cross-border Transferred
________When we received the Personal Data from the sources, the Company will collect, use, disclose, and/or cross-border transfer Personal Data that you have filled in including first name, last name, telephone number, and email which are stored in the database on Cloud storage provided service by the third party and only the Corporate Governance and Shareholder Engagement Section has the authority and access to the database.
________Providing Personal Data is voluntary. When you provide such Personal Data to the Company, the Company will collect Personal Data as stated above for the purposes specified in this Personal Data Protection Statement.
Purpose of the Collection, Use, Disclosure, and/or Cross-border Transfer of Personal Data
________The Company only collects, uses, discloses, and/or cross-border transfers your Personal Data to serve as a database for Company's complaints management.
Legal bases for the Collection, Use, and Disclosure of Personal Data
________The Company processes your Personal Data for the purpose of using them as a database for the Company's complaints management by relying on a legitimate interest basis.
________The Company may disclose your Personal Data to another person or a third-party organization, which may be located in Thailand or a foreign country, for the purposes specified in this Privacy Notice, as follows,
- PTT and PTTEP group companies for the purposes of internal auditing, following up on suggestions, examining complaints or claims, to prevent fraud, improper conduct, and wrongdoing or unlawful acts.
- Third-party service providers, which are located in Thailand or a foreign country such as IT system development companies, cloud storage service providers, etc. The Company will require third-party service providers to maintain confidentiality in the contract signed with the Company unless other legal basis or exceptions could be relied on in accordance with the laws.
- Government agencies and/or relevant regulators, only as necessary and requested, when permitted by law or under legal order.
________The Company may disclose and/or transfer your Personal Data to persons or organizations located in foreign countries in the cases where data storage units are located outside of Thailand or it is the sending of data to affiliated companies located outside of Thailand.
________In some cases, destination countries to which your Personal Data are sent or transferred may not have the same level of personal data protection standards as Thailand. In such cases, the Company will follow the procedures and implement measures to ensure adequate protection of Personal Data sent or transferred according to the law, which may include the use of the Personal Data Protection Policy for sending or transferring Personal Data to the data controller or data processor who is in a foreign country, and is in the same affiliated business, or in the same group of undertakings, for the purpose of a joint business or cooperation.
________The Company will store your Personal Data within the Company's database on the shared drive and cloud provided by the third-party service provider for as long as it is necessary to fulfil the purposes specified in this Privacy Notice unless otherwise specified by laws, or where the Company has the right or is able to rely on a legal basis to process your Personal Data. When such retention period expires the Company will delete, destroy, or anonymize your Personal Data within 60 days.
Standard of Sercurity Measures________The Company imposes access right to Personal Data and manages user access to the Personal Data to limit the access only to the authorized person; implements user responsibilities to prevent unauthorized access, disclosure, knowledge, or copy of the Personal Data, or theft of storage or processing equipment. In addition, the Company implements a method enabling the re-examination of unauthorized access, alteration, erasure, or transfer of the Personal Data to ensure its confidentiality, integrity, and availability in accordance with the minimum legal requirement.
Rights of the Data Subject________The data subject has the right to withdraw consent for the collection, use, and/or disclosure of your Personal Data provided to the Company; the right to access and obtain a copy of your Personal Data including the right to request the disclosure of acquisition of your Personal Data obtained without consent; the right to rectify your Personal Data; the right to delete your Personal Data or to de-identify them; the right to restrict the use of your Personal Data; the right to port your Personal Data in a structured, readable in electronic format, and transfer this data to another data controller; the right to object to the collection, use, and/or disclosure of your Personal Data; and the right to lodge a complaint against the Company to the Personal Data Protection Committee. For more details, you can learn more from the Personal Data Protection Policy available on the Company's website. (https://www.pttep.com)
Contact Channel of the Company