German Auto Company Limited (“we”, “us”, or “our”) is using closed-circuit television (CCTV) devices for monitoring our designated space within and around our buildings and facilities to protect life, health, and property. We collect personal data of all employees, directors, contractors, workers, visitors, or any individuals entering the monitored space within our buildings and facilities (collectively referred to as “you” or “your”) through the use of CCTV devices. We have therefore established a privacy notice to inform you about our practices for collecting, using, and disclosing (“processing”) personal data, including the various rights you have under the Personal Data Protection Act B.E. 2562 (PDPA). 

1. What personal data we collect

          Personal data means any information relating to a person, which enables the identification of such person, whether directly or indirectly, but not including the information of the deceased persons in particular.

          We collect personal data from you through closed-circuit television cameras (CCTV) located at the entrance and outside our building. This includes capturing still images, video footage, and images of objects such as bags and laptops.

2. The purposes for processing your personal data

          We process your personal data from CCTV and other personal data concerning you, for the “CCTV Monitoring Purposes” as listed below:

          2.1 to protect your health and personal safety, including your belongings;

          2.2 to protect our buildings, facilities and assets from damage, disruption, vandalism, and other crime;

          2.3 to support law enforcement organizations in the deterrent, prevention, detection, and prosecution of crime;

          2.4 to assist in the effective resolution of disputes which arise in the course of disciplinary or grievance proceedings;

          2.5 to assist in the investigation or proceedings concerning a whistleblowing complaint; and

          2.6 to assist in the establishment or defense of any civil litigation, including but not limited to employment proceedings.

          We will install CCTV devices in plain sight, in front of the entrance and outside of our office. The areas we will not install the CCTV devices are in the office or private areas such as toilets. 

          Our CCTV devices are in operation 24 hours a day and 365 days a year, and will capture no audio recordings. We will place signage at the entrance and exit points, and the monitored areas to alert you that a CCTV installation is in use.

          In cases where we need to collect your personal data to enter into a contract, perform a contract, or comply with the law, failure to provide such personal data may result in our inability to fulfill your request or achieve the purposes outlined in this privacy notice.

3. Legal bases for processing your personal data

          We will process your personal dataunder the following legal bases:

          3.1 Vital interest. It is necessary for our prevention or suppression of a danger to a person’s life, body, or health;

          3.2 Legitimate interest. It is in our legitimate interest to protect your health and personal safety, as well as your belongings, our buildings, facilities and assets, and to carry out any other acts to achieve the CCTV Monitoring Purposes. We will endeavor on the continuing basis to balance our legitimate interest and that of any relevant third parties, as the case maybe, and your fundamental rights and freedoms related to the protection of the CCTV Data concerning you.

          3.3 Legal obligations. We owe a duty to comply with the legal obligations prescribed by the applicable laws, including but not limited to the laws regarding safety and environment in the workplace. We consider the use of the CCTV as a necessary measure to enable us to meet those obligations.

          3.4 Other legal bases as permitted by Law.

4. To whom we may disclose your personal data

          Third parties to which we may disclose CCTV data and other personal data concerning you include:  

          4.1 Our affiliates. We may disclose or transfer CCTV data and other personal data concerning you to our affiliated companies, as part of our legitimate interest and our affiliates’ interest to achieve the CCTV Monitoring Purposes.

          4.2 Governmental and/or regulatory organizations. We may disclose or transfer CCTV data and other personal data concerning you to comply with legal obligations, or to support or assist law enforcement organizations with regard to the investigation and prosecution of civil or criminal proceedings.

          4.3 Third-party service providers. We may disclose or transfer CCTV data and other personal data concerning you as our necessary steps to ensure our protection of your health and personal safety, and belongings.

          4.4 Other third parties. This includes legal advisors and lawyers.

5. International transfers of your personal data

          We may transfer personal data to third parties or servers located outside Thailand. We will comply with the requirements of the Personal Data Protection Act B.E. 2562 (PDPA) and take measures to ensure the security of your personal data during such transfers. We will also ensure that the receiving party adheres to appropriate standards of protection, or any other derogations allowed by law.

6. Security measures

          We use reasonable organizational, technical, and administrative security measures to protect CCTV data and personal data concerning you from accidental, unlawful, or unauthorized destruction, loss, access, use, alteration, or disclosure.

          We will from time to time review and update our security measures as necessary or upon development of the concerning technology to ensure effective and appropriate security measures, and in line with minimum legal requirements as prescribed by the relevant governmental organizations.

7. How long do we keep your personal data

          We will retain your CCTV data in our system for the period necessary to fulfil our duties to achieve the CCTV Monitoring Purposes prescribed in this policy. When we are no longer permitted by the applicable laws to store your CCTV data, we will remove it from our systems and records.

          In the event a judicial or disciplinary action is initiated, your CCTV data may be stored until the end of such action, including any potential periods for appeal, and will then be deleted or archived as permitted by the applicable laws.

8. Your rights as a data subject

          Subject to applicable law and exceptions, before you exercise your rights, we may ask you to verify your identity. You have the following rights:

          8.1 Withdraw Consent : For the purposes you have consented to our processing of your personal data, you have the right to withdraw your consent at any time.

          8.2 Access : You have the right to access or request a copy of the personal datawe process about you, including asking us to disclose how we obtained your personal data.

          8.3 Data Portability : You may have the right to obtain personal datawe hold about you, in a structured, electronic format, and to send or transfer such data to another data controller, where this is (a) Personal datawhich you have provided to us, and (b) if we are processing such data on the basis of your consent or to perform a contract with you. 

          8.4 Objection : You have the right to object to certain processing of your personal data such as objecting to direct marketing.

          8.5 Deletion : You may have the right to request that we delete or de-identity personal data.

          8.6 Restriction : You have the right to restrict the use of your personal data in certain circumstances.

          8.7 Rectification : You may have the right to have incomplete, inaccurate, misleading, or not up-to-date personal data that we processing about you rectified.

          8.8 Lodge a complaint : You may have the right to lodge a complaint to the Expert Commitees where you believe our processing of your personal datais unlawful or noncompliant with applicable data protection law.

          You can exercise your rights as the data subject of the personal data mentioned above by contacting our Data Protection Officer, details of whom are provided at the end of this document. We may reject your request only in cases specified by law, such as a court order prohibiting it. We will notify you of the results of your request within the timeframe specified by law. If your request is rejected, we will inform you of the reason for the refusal.

9. Our contact details

          If you have concerns or questions regarding this policy or if you would like to exercise your rights in relation to your CCTV data, please contact us or our Data Protection Officer at

Data Protection Officer

          Email :  dpo@bmw-germanauto.com

          Address :  441 Debaratana Rd, Bangna Nuea, Bangna, Bangkok 10260