Privacy Policy for PERSONAL DATA PROTECTION
German Auto Co., Ltd. (“the Company”) recognizes the importance of personal data protection. In order for the Company’s personnel and related individuals to be aware of and understand personal data protection, the Company has established this Personal Data Protection Policy to define guidelines for operations related to the collection, use, and disclosure of personal data, in compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA), with the details as follows:
1. Objectives
1.1 To define the roles and responsibilities of departments, executives, employees, and personnel who are involved with personal data.
1.2 To define operational guidelines for employees related to personal data protection laws.
1.3 To build confidence in the security and safety of personal data for personnel, customers, trade partners, and other individuals who have a vested interest in or are related to the personal data.
2. Scope of Application
This policy applies to the Company, directors, executives, employees, Company personnel, and all external individuals involved in the processing of personal data on behalf of the Company.
3. Definitions
| Vocabularies | Meaning |
| The Company | German Auto Company Limited |
| Personal Data | Any information about a person which enables the identification of such person, whether directly or indirectly, but not including the data of the deceased in particular. |
| sensitive data | Personal data pertaining to racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability data, trade union data, genetic data, biometric data, or any other data which similarly affects the Data Subject, as prescribed by the Personal Data Protection Committee. |
| Data Subject | A natural person to whom the personal data relates, but not including the data of the deceased in particular. |
| Data Controller | A person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of personal data. |
| Data Processor | A person or a juristic person who undertakes the collection, use, or disclosure of personal data on the instructions of or on behalf of a Data Controller. In this regard, the person or legal entity undertaking such action shall not be a Data Controller. |
| Processing | Any operation performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, etc. |
| Personal Data Protection Law | The Personal Data Protection Act B.E. 2562 (2019) and other laws enacted under the Personal Data Protection Act B.E. 2562 (2019), both those currently in effect on the date of this agreement and those which may be supplemented or amended later. |
Other Definitions | In cases where this policy does not provide a definition, the definition shall be in accordance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA). |
4. Processing of Personal Data
The Company shall process personal data responsibly in its capacity as a Data Controller and/or a Data Processor, as follows:
4.1 The Company ensures that all personal data is processed lawfully, fairly, and with full transparency.
4.2 The Company processes personal data for specific, limited and lawful purposes.
4.3 The Company processes personal data only to the extend necessary and relevant to the related purposes.
4.4 The Company ensures that personal data is accurate, up-to-date, and not misleading.
4.5 The Company retains and processes personal data only for the period necessary to fullfill the processing purposes.
4.6 The Company processes personal data using security measures prescribed by law.
4.7 The Company act responsibly in all aspects to ensure compliance with the Personal Data Protection Law.
5. Management of Personal Data Protection
5.1 The Company shall establish an organizational structure for the protection and supervision of personal data, with clear reporting and responsibilities.
5.2 The Company shall prepare policies and operational guidelines for personal data protection to ensure personnel understand their own roles and responsibilities regarding personal data protection.
5.3 The Company shall create awareness, provide training on personal data protection, and monitor and evaluate the training.
5.4 The Company shall prepare a Privacy Notice with important content and details required by law, using appropriate, transparent, and effective communication channels.
5.5 The Company shall inform the Data Subject of their rights as prescribed by law, channels for exercising those rights, as well as the process for responding to requests to exercise rights.
5.6 The Company shall prepare a record of processing activities (RoPA) with important details according to legal requirements and in compliance with legal bases.
5.7 The Company shall establish agreements concerning personal data protection or comply with legal requirements in cases of sharing or disclosing personal data, or sending or transferring personal data abroad, in accordance with legal requirements.
5.8 The Company shall arrange for personal data protection risk management, and if necessary, the Company will conduct additional Data Protection Impact Assessments.
5.9 The Company shall arrange for security measures covering all forms of personal data, according to accepted standards and legal requirements.
5.10 The Company shall implement measures for managing personal data breaches.
6. Roles, Duties, and Responsibilities
Executives and Directors bear the duty and responsibility of monitoring and controlling that all departments comply with this policy. Also, their duty to promote a cultual awareness throughout the Company, making personal data protection an integral part of the Company’s operations.
Furthermore, Executives and Directors shall define processes for monitoring legal compliance and reviewing working guidelines to ensure they align with the law.
The Personal Data Protection Working Committee or the Data Protection Officer (DPO) has the duty and responsibility to provide advice, audit, and supervise to ensure personal data management is compliant with the law, and to report the results to the Executives and Directors.
The Company’s employees have the duty and responsibility to comply with the policy, working processes, and relevant personal data protection laws, as well as to report abnormal events concerning the personal data protection process to their supervisor.
7. Additional Provisions
In addition to the powers and duties under Section 6. and as prescribed by law, the Personal Data Protection Working Committee and the Data Protection Officer (DPO) have the authority to issue additional measures, guidelines, manuals, and recommendations concerning personal data protection to the Company.
8. Penalties
Any person responsible for performing any task according to their duties who violates the policy and guidelines related to personal data protection and/or as stipulated by the Personal Data Protection Act B.E. 2562 (2019) may be subjected to the Company’s disciplinary actions.
Furthermore, if such action causes damage to the Company and/or any other person, the Company may consider further legal action.
9. How to Contact the Company
If you wish to contact us to exercise the rights relating to your personal data or if you have any queries about your personal data under this privacy notice, please contact us or our Data Protection Officer at
Data Protection Officer
Email : dpo@bmw-germanauto.com
Address : 441 Debaratana Rd, Bangna Nuea, Bangna, Bangkok 10260
10. Amendment of the Policy
The Company will regularly review the Personal Data Protection Policy , and in the event of any amendments or changes, will announce them within 30 days from the date of revision.
