Rocket Innovation Co., Ltd. (“the Company”) is established in Thailand. This Privacy Notice explains how we collect, use, and/or disclose your personal data if you are an employee, job applicant, or other person connected with the Company (for example a family member or emergency contact named by an employee). It applies including when you are located outside Thailand.
The Company respects your privacy and is committed to protecting your personal data under the Thai Personal Data Protection Act B.E. 2562 (2019), as amended from time to time (the “PDPA”), and other laws and regulations issued under the PDPA. Where we process personal data of people outside Thailand, we still apply this notice and the safeguards described below, including for cross-border transfers.
Personal data means information about an individual that can identify that person, directly or indirectly. It does not include information about a deceased person.
The Company is the data controller for the processing described in this notice.
1. Purposes of collection, use, and disclosure
We collect, use, and disclose your personal data only as necessary for our lawful purposes. The main purposes are:
- To consider employment.
- To keep Company records for communication and day-to-day work.
- To provide health insurance, a provident fund, social security, annual health checks, and other benefits.
- To pay salary and allowances and to handle tax deductions.
- To verify identity for time-in / time-out records and to protect the security of the workplace.
- For emergencies.
- To verify identity in order to perform a contract, or to take steps at your request before the Company enters into a contract with you.
- To grant authority to act on the Company’s behalf.
- For other legitimate interests of the Company, unless those interests are overridden by your fundamental rights in your personal data.
Our legal bases under the PDPA are: contract, the Company’s legitimate interests, compliance with a legal obligation, and consent (where consent is required). These map to the lawful bases commonly used in other jurisdictions, including contract, legitimate interests, legal obligation, and consent.
2. Sources and types of personal data
We collect and use several types of personal data, depending on the situation.
2.1 Sources
We collect your personal data from sources such as:
- Information you give us directly — for example from a job application, or other information you provide to the Company.
- Information we receive from third parties — for example referee details we receive from an applicant, or family details of an employee that the employee gives us.
2.2 Types of personal data
- Identity data: first name, last name, gender, date of birth, age, education level, nationality, photograph.
- Application data: employment certificates, evidence of military conscription, CV, training history, work experience, and other personal data in documents received from you and related organisations.
- Identity-verification data: national ID number, house registration, passport number, other government-issued numbers, personal data on government identity documents, tax identification number, image on a national ID card, passport, driving licence, and signature.
- Image data: photographs, CCTV images or recordings.
- Contact data: address, place of contact, telephone number, email, LINE ID.
- Financial data: bank account details, commercial registration number, billing address, credit-card number, cardholder name, and other card details.
- Data about other people connected with employees, workers, and applicants:
- Emergency contact: name, relationship, address, telephone number.
- Family: full name, age, occupation/position, address/workplace, telephone number, marital status, number of children.
- Referees: full name, age, occupation/position, address/workplace, telephone number.
- Sensitive personal data:
- Criminal-record history (in some cases only).
- Sensitive data needed for labour protection, social security, the national health-security scheme, statutory medical-welfare benefits, motor-accident protection, or social protection (as applicable) — for example health data and disability data.
- Sensitive data on a national ID card, such as blood type and religion.
- Fingerprints and facial-scan data.
- Health data, medical history and treatment; and
- Other sensitive personal data, as the case may be.
We will not collect, use, and/or disclose your sensitive personal data without your explicit consent, unless the law allows us to do so.
2.3 If you refuse to provide personal data
If we need your personal data and you do not provide it, we may have to refuse related actions. For example, if we need the data to enter into a contract, you may not be able to contract with the Company.
2.4 Retention
We keep your personal data only as long as needed to fulfil the purposes of collection, use, and disclosure. We generally retain it for about 10 years after our relationship with you ends, then destroy, delete, or anonymise it. We may keep it longer where we have a legal reason to do so.
4. Disclosure of personal data
We may disclose your personal data to third parties such as service providers and professional advisers for the following purposes:
- To comply with any applicable legal requirement, or with service terms and other agreements.
- To protect the rights, property, and safety of the Company and of companies in our group.
- For legal process or legal proceedings.
- For a business transaction (for example a purchase, sale, lease, merger, acquisition, disposal, or financing of the organisation or any part of its business or assets) to which the Company is or may become a party.
We may also disclose or transfer your personal data to other third parties, including:
- Subcontractors, agents, or any service providers who work for or serve the Company — for example carriers — including their subcontractors, providers, supervisors, and staff.
- Government authorities, such as public-health authorities and local administrative organisations, for permit applications or for the Company to comply with law.
- Law-enforcement authorities, government, courts, dispute-resolution bodies, the Company’s regulators, auditors, and any person appointed or requested by a regulator to review the Company’s activities.
- Auditors and other reviewers appointed or requested by a regulator to review the Company’s activities.
- Persons appointed to administer any of your interests.
- Any person or company involved in a restructuring, merger, or acquisition that has occurred or may occur, including a transfer of any rights or duties the Company has under a contract with you.
- Any other person connected with a dispute, including a dispute about a transaction.
- Anti-fraud bodies that use the data to detect and prevent fraud and other financial crime.
- Financial institutions and payment-service providers.
- Intermediaries, contact persons, and your agents.
- Any person who instructs or administers your accounts, goods, or services on your behalf (for example an attorney-in-fact or lawyer); and/or
- Any person you have instructed us to disclose your personal data to.
If we must send your personal data to a data processor, we will contract with that processor so it has adequate measures to protect your personal data, so you can exercise your rights, and so legally enforceable remedies are available.
5. Cross-border transfer of personal data
We may send or transfer your personal data outside Thailand for storage and/or for collection, use, and disclosure in order to perform a contract between you and the Company. We will not allow unrelated persons to access that personal data.
Transfers are made in accordance with the PDPA. We put in place the necessary and appropriate safeguards. If you are outside Thailand, this may include transferring your data to or from your country so we can perform an employment or related contract.
6. Your rights
You have the following rights under the PDPA. These correspond to the data-subject rights recognised in many other jurisdictions:
- Right to withdraw consent.
- Right to access and obtain a copy of your personal data that we hold, or to be informed how we obtained personal data that you did not consent to provide.
- Right to receive your personal data and to have us send or transfer it to another data controller (data portability).
- Right to object to the collection, use, or disclosure of personal data.
- Right to request that we erase or destroy personal data, or make it so that it can no longer identify you.
- Right to request that we restrict the use of personal data.
- Right to request that we rectify your personal data.
We may refuse a request where the PDPA or other applicable law allows. To exercise these rights, contact us using the details in section 8.
7. Security of your personal data
We take the security of your personal data seriously. We regularly review and apply appropriate organisational, physical, and technical security measures when storing, collecting, using, and disclosing your personal data, so that it is not lost, accidentally destroyed, disclosed, used for an unintended purpose, or accessed by anyone other than employees or persons who collect, use, and disclose personal data on the Company’s instructions.
8. Complaints and questions
You may contact the Company to complain about how we collect, use, and disclose your personal data, or to ask a question, at:
Name: Rocket Innovation Co., Ltd.
Address: 5th Floor, Mobicom 3 Building, 101 Soi Praphinit, Naradhiwas Rajanagarindra Road, Thung Maha Mek, Sathon, Bangkok 10120, Thailand
Data Protection Officer: info@rocket.in.th
If the Company or its employees fail to comply with personal-data protection law, you may lodge a complaint with the Office of the Personal Data Protection Committee, 120 Moo 3, 6th–9th Floor, Ratthaprasasanabhakti Building, Government Complex Commemorating His Majesty the King’s 80th Birthday Anniversary, 5 December 2007, Chaeng Watthana Road, Thung Song Hong, Lak Si, Bangkok 10210, Thailand. Tel: +66 2 142 1033. Email: pdpc@mdes.go.th
If you are outside Thailand, you may also contact your local data-protection or privacy authority. The Thai PDPC remains the supervisory authority for this notice.
9. Changes to this Privacy Notice
We will review this Privacy Notice regularly and may change it as needed.
This Privacy Notice was last updated on 1 April 2024.