German Auto Company Limited (“we”, “us”, “our”) uses Closed-Circuit Television (CCTV) equipment to monitor the areas within and around our buildings and premises to protect life, health, and property. We collect the personal data of all employees, directors, contractors, visitors, or any individuals who enter the monitored areas within the buildings and premises via CCTV (collectively referred to as “you”).

          We have therefore established this privacy notice to inform you of our practices regarding the collection, use, and disclosure (“Processing”) of personal data, as well as the various rights you are entitled to under the Personal Data Protection Act, B.E. 2562 (2019) (PDPA).

1. Personal Data We Collect

          Personal Data means any information relating to a natural person that enables the identification of such person, whether directly or indirectly, but does not include the data of deceased persons specifically.

          We collect your personal data through CCTV when you enter the monitored areas at the front of the entrances and outside our building premises. Personal data is collected in the form of still images, moving images, and images of belongings (e.g., bags, laptops).

2. Necessity of Processing Personal Data

          In cases where we need to collect your personal data to enter into a contract, perform a contract, or comply with the law, if you do not provide such personal data, we may be unable to proceed with your request.

          We will install CCTV cameras in visible locations at the front of the entrances and outside our building areas. We will not install CCTV cameras inside buildings and in private areas such as restrooms. We will install signs at entry and exit points and in areas under CCTV surveillance to inform you that CCTV cameras are in operation in that area.

3. Legal Bases and Purposes for Processing Personal Data

          We process your personal data from CCTV and other related personal data based only on legal grounds permitted by law, such as for the prevention of danger to life or health (Vital Interests), for legitimate interests, or for the management of legal claims. If no other basis can be used, we will request your consent.

          We process data to fulfill the following purposes:

          3.1 To protect vital interests: Such as preventing or suppressing danger to the life, body, or health of a person.

          3.2 For legitimate interests: Such as maintaining the security of our company, employees, and visitors, as well as your property, our buildings, premises, and assets; resolving disputes; and preventing crime.

          3.3 To comply with legal duties: Such as complying with orders from competent government authorities.

          3.4 For other purposes: Such as managing our legal claims, including but not limited to civil, criminal, and labor cases.

4. Parties to Whom We May Disclose Your Personal Data

          We may disclose your personal data to others as permitted by law, including the following:

          4.1 Government Agencies: E.g., the Revenue Department, Social Security Office, Department of Labour Protection and Welfare, courts.

          4.2 Business Partners: E.g., affiliated companies, BMW Group, financial institutions, insurance companies, and other relevant business partners.

          4.3 Service Providers: We may engage other companies, agents, or contractors to provide services on our behalf or to assist in our business management, such as IT providers, logistics and transport providers, payment providers, market analysis providers, marketing and advertising media, campaign organizers, telecommunication providers, external administrative services, data storage and cloud providers, printing services, and training providers.

          4.4 Other Third Parties: E.g., business consultants, auditors, legal advisors, parties to whom you request disclosure (e.g., financial institutions, new employers), assignees of rights or debts, associations, and non-profit organizations.

5. Personal Data Retention Period

          We will retain your personal data for the period necessary to achieve the purposes related to this privacy notice. Normally, footage is overwritten every 90 days, but we may retain it for longer if there is a necessary purpose, such as until a legal dispute is concluded.

          However, in the event of legal or disciplinary proceedings, your CCTV data may be stored until the conclusion of such proceedings, for example, until the case is final.

6. Your Rights as a Data Subject

          You have the right to take action under the Personal Data Protection Law. We may ask you to verify your identity before fulfilling your request.

          6.1 Right to withdraw consent: You have the right to withdraw your consent at any time for activities to which you have given consent, subject to conditions prescribed by law.

          6.2 Right to access: You have the right to access and receive a copy of your personal data under our responsibility, and to request that we disclose how we obtained your personal data, subject to conditions prescribed by law.

          6.3 Right to data portability: You have the right to receive your personal data if we have arranged it in an electronic format that is readable or commonly used by automated means. You also have the right to request that we transfer such data to another data controller automatically, and the right to directly receive the data that we transfer to another data controller, subject to conditions prescribed by law.

          6.4 Right to object: You have the right to object to the processing of your personal data, subject to conditions prescribed by law.

          6.5 Right to erasure: You have the right to request the erasure or destruction of your personal data, subject to conditions prescribed by law.

          6.6 Right to restriction of processing: You have the right to request the temporary suspension of the use of your personal data, subject to conditions prescribed by law.

          6.7 Right to rectification: You have the right to request that your personal data be corrected, updated, complete, and not misleading, subject to conditions prescribed by law.

          6.8 Right to lodge a complaint: You have the right to complain to the expert committee under the PDPA if you believe we have violated or failed to comply with the law.

          You can exercise your rights as a data subject by contacting our Data Protection Officer using the details at the end of this document. We may refuse your request only in cases specified by law, such as a prohibiting court order, and we will inform you of the outcome within the period prescribed by law. If we deny the request, we will inform you of the reason for the denial.

7. Security of Personal Data

          We will maintain the security of your personal data in accordance with the principles of confidentiality, integrity, and availability. This is to prevent loss, unauthorized access, use, alteration, correction, or disclosure. We will implement security measures for personal data that comply with legal requirements.

8. International Transfers of Personal Data

          We may transfer personal data to the BMW Group, third parties, or servers located outside of Thailand. We will follow the procedures stipulated by the PDPA and implement measures to ensure that your personal data is transferred securely and that the receiving party has appropriate protection standards or that other exceptions permitted by law apply.

9. Contact Information

          If you have questions, complaints, access requests, or any inquiries regarding this privacy notice and/or wish to verify what personal data of yours is in our possession, you can contact us through our channels:

          German Auto Company Limited Address: 441 Thepharat Road, Bang Na Nuea, Bang Na, Bangkok

          Data Protection Officer

          Email :  dpo@bmw-germanauto.com

10. Amendments to this Privacy Notice

          We may update this Privacy Notice from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any significant changes through our website or our other communication channels.

          This notice was last updated and is effective from September 1, 2025.