Privacy Policy for DEMCO’s employees

To keep employees' personal information collected. In order to comply with the Personal Data Protection Act B.E. 2562 (2019), DEMCO has established this policy which is an extension and part of the "Personal Data Protection Policy of the Demco Group". Control data users and related employees strictly follow the As follows:

The definition of "Data Subject" in this Policy includes:

Job Applicants	Means	a person who has expressed his intention to be selected as an employee ofDemco
Employees	Refers to	employees under labor contracts.
Contractor Employees	means	a person or juristic person who procures wage contractors. Occasionally works for Demco's business.

In the event that this policy uses the term “Employees” It also includes job applicants and wage contractors. Other than as set forth above, the Personal Data Protection Policy of the Demco Business Group

Purpose of Personal Data Processing
1. To process the data subject's request.
  - To be used to process the request before entering into a labor contract (for job applicants).
  - For the performance of labor contracts or other related contracts.
2. For the performance of a contract.
  - Employees are parties to a contract with DEMCO, for example, in the preparation of employment contracts. Employment Contract Performance Agreement Compliance with Demco's Personnel Management Regulations and Regulations, Code of Conduct, Assignment of Work Employee migration, relocation of employees to work on site, training, performance evaluation. Consideration of job positions and remuneration, administration and care for employee health and safety, disbursement of money related to or used in the performance of employment contracts.
  - The use of employee personal information in business operations related to the performance of the employee's duties, such as the use of the name and license number of the employee who is the supervising engineer in the pre-contract process, such as bidding, contracting, etc. Deliver work between DEMCO and customers or partners, etc.
3. For DEMCO's compliance with the law as a data controller, such as:
  - Compliance with the provisions of laws, regulations, and orders of persons with legal authority, such as labor protection laws. Labor Relations Law, Social Security Law Safety, Occupational Health and Working Environment Law Law on Occupational and Environmental Diseases Communicable Disease Control Act Computer Crime Act Suspension of salary according to the Civil Procedure Law, etc.
4. For DEMCO's legitimate interests , such as human resource management. Study, analysis and allocation of manpower Employee Development Implementing employee activities that help build employee relationships in the organization. Provision of medical benefits Insurance and other benefits for employees such as medical facilities. Financial and budget management, internal contact, contact with third parties for the pre-contract process, such as bidding, authorization, etc. Preparation of certificates, submission of information to government agencies, identity verification. Authorize and grant access to the accuracy of the information received from employees. Monitor employee performance Analysis and preparation of databases on work history, contacts, Improving the working environment Provision of facilities Information security, user account creation, Identification to access work systems and access to information systems, security, accident and crime prevention. Investigation and handling of complaints of fraud Cases or disputes, taking care of employees after the termination of their status as employees, etc.
5. To prevent and suppress danger to life. Physical or health of employees or other persons, such as emergency contact, control and prevention of communicable diseases.
6. To achieve the objectives of activities or projects for which DEMCO relies on the consent of employees on a case-by-case basis.
The processing of your personal data in accordance with the purposes of Clauses 2.1 2.2 2.3 2.4 2.5 Demco can be done without consent as required by law. For other purposes that require consent, You can find details about consent in Section 10.
Retention and Use of Employee Personal Information
1. The Demco Group respects the privacy rights of its employees to the utmost.
2. Demco Group will only request personal information from employees as necessary for administration, as required by law, or as required by relevant organizations and agencies.
3. Demco Group provides for the storage, retention and use of personal data in a concise manner and confidentiality.
4. The Demco Group clearly defines the duties of data collectors, data processors, maintainers, users, and user approvals, as well as verification procedures, to ensure that employees' personal data is kept safe and used in good faith.
5. All employees of the Data Subject The Company has the right to request to be viewed and inspected at all times during the retention period, including the duty to provide additional information in the event of any change in the personal data or submission of the information in the event that DEMCO or related agencies request more.
6. The information of foreign employees will be stored, maintained, and used the same information as Thai employees.
7. In case a person or external agency wants to know any information of the employee, it shall be made in writing. Specify the reasons for the need to be approved by the data controller first. Do not disclose or give without approval.
8. In the event that a government agency requests information from an employee, it shall notify the data controller to consider/review it before sending it, except for the regular period required by law, such as social security, revenue, labor protection, etc., and the submission shall be sent immediately and the submission shall be recorded for inspection.
9. The transfer of employees' personal information abroad shall be approved by the Chief Executive Officer/Managing Director and strictly in accordance with the law.
10. Personal information of employees held by Demco Demco will maintain it as if it were Demco's own property. No one is allowed to infringe, disclose, access, use for personal gain, or destroy This information is not approved by the person assigned by Demco. Violators will be punished at the highest rate and/or prosecuted to the end, including full compensation for damages incurred at the rate prescribed by law.
11. The retention, use, review, review, approval, or other processing of personal information in accordance with this Policy shall be kept confidential to the extent necessary in good faith, and the personal information of this employee shall be treated as confidential to the highest degree.
Disclosure of Employee Information
DEMCO discloses or transmits or transfers employee information and/or special personal information to third parties. Data Processors or legal agencies for the following purposes:
1. For the purpose of carrying out job application activities. Perform the contract and/or any other agreement related to the foregoing. DEMCO may send, transfer, or disclose personal data and/or sensitive information of employees to data processors, third parties who are consultants or service providers, etc.
2. DEMCO may disclose your personal data and/or sensitive information to internal and external audit departments. Thai Life Insurance Association Insurance Business Supervision and Promotion Committee Anti-Money Laundering Commission The Anti-Money Laundering and Terrorism Agency, both domestically and internationally. Police Officer Public prosecutors or courts, officers of the Enforcement Department. Receiver Officer, Revenue Department Officer government officials or any other organization with the powers and duties prescribed by law
3. DEMCO may need to disclose the personal data of the data subject to the Demco Group or other persons both domestically and internationally, such as service providers who have to carry out operations related to personal data. Demco will ensure that such individuals keep their personal information confidential and not use it for any purpose other than to the extent specified by Demco.
4. DEMCO may disclose the personal information of the data subject. Under the criteria prescribed by law, such as disclosure of information to government agencies, government agencies, Regulatory agencies, including in the case of requests for disclosure of information based on legal authority, such as requests for information for lawsuits or legal proceedings, or requests from private agencies or other third parties related to legal processes, etc.
The disclosure or transmission or transfer of your Personal Data for the purposes of Clauses 4.1, 4.2, 4.3 and 4.4 Demco can be done without consent as required by law. For other purposes that require consent, You can find details about consent in Section 10.

If the person receiving the information has the status of a personal data processor, DEMCO will proceed to prepare a contract and make an order as required by law.
Types of Personal Data Collected
1. Information and documents related to the recruitment process, such as resumes, cover letters, job applications, and opinions on recruitment.
2. Contact information with employees, such as name, surname, address. Phone Number, Email
3. Information about the employee, such as date of birth, age, gender, marital status, interests, opinions, etc.
4. Information about family members Marital status, list of spouses, children, or dependents of employees who are entitled to receive benefits in accordance with Demco's Personnel Management Regulations and Regulations to provide additional benefits, such as information about spouses, information about children, etc. Information about parents and beneficiaries Before providing information to Demco, employees must also inform such persons of this Privacy Policy.
5. Maps, photographs, and animations, or other information about the residence to consider a sick visit. Visiting the delivery or other difficulties as well as building a good relationship with the employee's family.
6. Information about the employee's education, abilities and potential development, and other qualifications, such as education level, educational qualifications, institution/university, educational history, training history, educational results, test results. The right to work legally Professional qualifications Information based on referrals provided by employees to Demco.
7. Information about work experience and information about past employment, such as job titles. Details of the employer, salary and compensation Benefits
8. Information about the place where the work can be performed.
9. Information about military loads
10. Information about employee characteristics, such as habits, behaviors, attitudes, aptitudes, skills, leadership Ability to work with others Emotional intelligence, and commitment to the organization, which may be obtained from the observation and analysis of DEMCO and its employees during their work or participation in activities with the Demco Group.
11. Information required for reporting to a regulatory body, such as the Ministry of Labour. The Stock Exchange of Thailand The Securities and Exchange Commission (SEC) Thai Institute of Directors Association (IOD)
12. Financial information such as wages, salaries, income, taxes, provident funds, etc. Bank Account Borrowing money Tax Exemptions or Deductions Holding of the Company's securities Company Name
13. Information related to social security, labor protection. Benefits, welfare and benefits that employees receive or are entitled to receive in accordance with DEMCO's Articles of Association and Personnel Management Regulations.
14. Record of attendance and duration of work Overtime Absences and leave
15. Job History Information Attending meetings and giving opinions As a director of the Company, information and profiles of directors will be added. Register of Directors
16. Information on the use and access to information systems, computers, work systems, websites, applications, and network systems. This is in line with the information technology policy of the Demco Group and related laws.
17. Information collected from your engagement with Demco, such as participation in events. Survey Response Assessment
18. The information selected by employees will be shared and disclosed through the system. Demco's applications, tools, questionnaires, assessments, and documents.
19. Copies of documents that can be used to identify the employee, such as an ID card. Passport, other documents issued by government agencies, civil registration.
20. Details of who Demco can contact in case of emergency.
21. Information about vehicles, car registrations, motorcycles for entry and exit permits, Demco's area, or arrangement of safe and adequate parking spaces. Driver's license, ability to drive a vehicle, and the case of an employee driving a vehicle provided by Demco. Demco will also collect information about the driving habits of employees, such as the use of the GPS tracking system of Demco's vehicles that employees use.
22. Other information necessary to investigate conflicts of interest, such as shareholding information and relationships with business partners.
23. Information about accidents, whether in the event of an employee's accident at work or due to the performance of his or her work, and other accidents.
24. Other information necessary for the performance of labor contracts. Taking care of welfare benefits Demco's analysis and administration Employee care after termination of employment and compliance with various laws
25. Information about complaints Whistleblowing, investigation, disciplinary action
However, If an employee refuses to provide personal information required to perform a law or contract with Demco, or to enter into a contract with Demco, it may jeopardize the performance of the contract and the right to access the benefits or services provided by Demco. It is not possible to perform it completely.
Special Categories of Personal Information
1. DEMCO may need to collect and/or process and/or disclose special types of personal data of employees. For the purposes specified by Demco in Clause 2 or Clause 4 of this Policy.
  - Health information such as weight, height Underlying diseases, color blindness, physical examination results Food Allergy Information Drug allergy information Blood type Medical certificates, medical treatment records, medication dispensing history, and medical receipts for labor protection and provision of medical benefits for employees. Assessment of employee working capacity, including compliance with relevant laws, such as the Ministerial Regulation Prescribing Criteria and Methods for Health Examination of Employees and Submission of Test Results to Labor Inspectors, B.E. 2547 (2004), and to study and analyze employee health data for other appropriate management.
  - Biometric data, such as fingerprint simulation data. Facial image data to be used to identify and verify the identity of employees. Crime prevention and protection of the legitimate interests of DEMCO or other persons.
  - Information about criminal records To determine the appropriateness of performing work and protecting the legitimate interests of DEMCO or other persons.
  - Beliefs in religious creeds, philosophies, races, nationalities, disabilities Trade union information, genetic information, and biological information to support the provision of facilities. Activities and welfare appropriate to employees, including for the management of employee care in an equitable and fair manner in accordance with human rights principles.
  - Other special types of personal data for lawful purposes, such as to prevent or suppress danger to life. It is information that is publicly disclosed with the explicit consent of the employee in order to exercise the legal claim to achieve the objectives of labor protection, social security and employee welfare.
2. Demco will only process the special type of personal data of employees in accordance with Clause 6.1 in cases where it is necessary for the purposes specified in Clause 2 or Clause 4 with the explicit consent of the employee or for other purposes as required by law. However, DEMCO will make its best efforts to provide adequate security measures to protect the special personal information of its employees.
3. Information about criminal records, which will be collected from evidence presented by the employee or consented to be investigated by the competent authority according to the law. Demco will provide such data protection measures as required by law.

Regulations and Guidelines for Persons with Functions Related to Employees' Personal Information

To provide storage, use, control. In accordance with DEMCO's various personal data protection policies and the requirements of relevant laws, the Demco Group of Businesses defines the duties and responsibilities of relevant employees. As follows:

The Managing Director and Chief Executive Officer have the following duties:
1. Appoint Data Controllers, Data Users, Processors, Keeping information up to date, confidential and in accordance with required laws.
2. Review/approve the use of Control of personal data in excess of the authority of the data controller or the transmission of employee information to relevant external or foreign agencies.
3. Arrange for a review of the collection and treatment. Use personal information at least once a year to ensure that the control of employees' personal information is in accordance with policies and laws.

The HR manager has the following duties:

To be the controller of the use of personal data of all employees within the scope and as necessary for the management of the business, and to be the controller of personal data as prescribed by the Personal Data Protection Act.
Provide details about the employee information to be collected. Maintain and control the personal data that needs to be used and the reason for the need to use it.

Determine how and where to store secure data

A.	Documentation The filing cabinet must have an on-off key, only for the person involved.
B.	Storage on a computer or information system must have a password only for the person who keeps it.
C.	Access to additional information, but it cannot be deleted, changed, or arbitrarily removed. Approval from the data controller is required.

Organize meetings to educate and publicize the employees to understand the reasons and necessities for this policy and procedures, as well as to know the rights and duties under this policy.
Consider and approve the change. Requesting the use of employee personal information that is necessary for Demco's work or that is beneficial to the data subject.
Collect backup keys or recognize passwords into the computer system of data users for use in urgent cases.
If there is an irregularity in the collection, retention, or use of information that is not in accordance with the policy or is contrary to the law required to suspend it. Immediately stop the abnormality and report it to the Chief Executive Officer and Managing Director for correction and prevention in time.
Review and audit the collection of personal data at least once a year to ensure that employees' personal information is collected. Maintain and use in accordance with policies or laws.
Prepare personal data reports as required by law and be audited and/or sent to the agencies required by law.
Usage Notes Retention of information for audit purposes to ensure compliance with this policy.

Recruitment employees collect, process, record, maintain, and use personal data related to job applications.
1. The information of the job applicant shall be kept at all times and not less than 2 years after the termination of the employee status or until the end of the case (if any).
2. The information of job applicants who are not accepted for work shall be kept for at least 3 months.
3. The method of destroying the information shall be subdivided or burned or other methods that ensure that no other person knows about the information.
4. Collect keys or passwords related to data collection.
5. Records of use, change, retention, and retention of information for audit to ensure compliance with this policy.
Employees who pay wages, salaries, benefits.
1. Data Processor Storage Maintain personal information related to wages, benefits, social security, and income tax of each employee.
2. Eligible to request additional personal information documents for annual tax calculation or to provide additional benefits during the year.
3. Issuer of wage certificates or other information requested by the data subject.
4. Retain wage information at all times as required by the Revenue Department.
5. Collect keys or passwords related to data collection.
6. Usage Notes Retention of information for audit purposes to ensure compliance with this policy.
Occupational Safety Officer
1. Keep employee illness information confidential
2. Coordinate with doctors or relevant agencies for treatment or compliance with the law.
Information managers or specialized experts will provide advice on how to keep personal information confidential in the information system to ensure that the information is complete. The name of the user, the date and time of use, as well as the designation, supervision, and audit of the information staff (IT) to process personal data into the information system in a confidential manner.
Information Officer Process data and set a password to store Maintain confidentiality of information, prevent abuse, destruction, and ensure compliance with this policy.
Managing Director Chief Executive Officer Personnel managers or related persons Make a review, add more, cut it out. Personal data stored at least once at a time to ensure the retention of The use of employee personal information is in accordance with the policy. Relevant and up-to-date legislation
In the operation or use of network and computer systems of the Demco Group. All types of employees must comply with the Network and Computer Usage Policy. Network and Computer Usage Policy

Use of Cookies
Demco uses cookies to collect personal information related to the use of Demco's website as set forth in the Cookie Policy.
Additional Access, Audit and Notification Rights Employee Personal Information
Employees who are the subject of personal data at DEMCO Retain and preserve They have the following rights and obligations:
1. have the right to request a preservation inspection. The data can be used every day during working hours by notifying the Data Controller (Personnel Manager) to process the process.
2. Employees have the right to withdraw the consent they have given to DEMCO to process their personal data.
3. They have the right to obtain certification and copy or use their own personal data only. By notifying the Data Controller (Personnel Manager) to process the
4. The Company is obliged to deliver any documents or personal information requested by Demco within the specified time.
5. It is responsible for notifying any personal information that has changed, such as change of name, surname, relocation. Marital status and childbearing to Demco within 7 days.
6. It is responsible for reporting significant personal information such as infectious diseases, epidemics, psychiatric diseases, etc. Drugs Crime or any illegal acts that affect health, safety, life, property, or order in collaboration by immediately notifying the head manager or personnel manager for consideration, prevention, and assistance in time.
7. The Company has the right to suspend the use, deletion or destruction or make personal information only for themselves. Anonymous information
Obtaining consent and the possible consequences of withdrawing consent
1. In the event that DEMCO collects and processes the Employee's Personal Data for purposes other than Clauses 2.1, 2.2, 2.3, 2.4, 2.5, and in the event that DEMCO discloses the Employee's Personal Data for purposes other than Clauses 4.1, 4.2, 4.3, 4.4, Demco will seek the consent of the employee, who has the right to withdraw the consent of the employee given to Demco at any time. Withdrawal of this consent will not affect the collection. use, disclose or process personal data that employees have given consent to.
2. If an employee withdraws the consent provided to DEMCO or refuses to provide certain information, it may result in DEMCO not being able to carry out some or all of the purposes set forth in this Privacy Policy.
Retention Period of Personal Data
1. DEMCO will retain employee personal information for as long as necessary to achieve the purposes for each type of personal information, unless a longer retention period is permitted by law. In the event that the retention period of personal data cannot be clearly specified. Demco will retain information for a period of time that may be expected to meet the standards of collection (e.g., a maximum of 10 years under common law).
2. DEMCO retains employee personal information for the duration of their employment with DEMCO for the performance of the contract and for as long as necessary after the end of their employment with DEMCO.
3. DEMCO retains the personal data of family members or dependents of DEMCO employees for as long as necessary for the processing to fulfill the purposes of this Privacy Policy, in particular in response to the employee's right to receive benefits in accordance with DEMCO's Personnel Management Regulations and Regulations.
4. In the event that DEMCO uses the employee's personal information with the employee's consent, DEMCO will process such personal information until the employee requests to withdraw consent and DEMCO has completed the employee's request. However, Demco will continue to retain employee personal information to the extent necessary for the record of the employee's past withdrawal of consent so that Demco can respond to future employee requests.
5. DEMCO has established a monitoring system to delete or destroy personal information when the retention period has expired or is irrelevant or unnecessary for the purpose for which the personal data was collected.
Security measures for personal information
1. The security of employee personal information is important to DEMCO and has implemented appropriate technical, administrative, and physical security standards to protect personal information from loss. Unauthorized Access, Use or Disclosure Misuse Employees are trained on the importance of protecting personal information, altering and destroying using security technologies and procedures, such as encryption and access restriction, to ensure that only authorized persons have access to employees' personal information, and that these individuals are trained on the importance of protecting personal information.
2. DEMCO has put in place appropriate security measures to prevent the loss, access, use, alteration, modification or disclosure of personal data from persons who do not have the rights or duties related to such personal data, and will arrange for such measures to be reviewed when necessary or when technology changes to ensure appropriate security effectiveness.
Penalties for violators of this Code and/or violation of employees' rights to personal data
1. Which employee discloses? Use, abuse, or use the personal information of other employees or use it for personal gain without the approval of the Data Controller (Personnel Manager) or the Chief Executive Officer, Managing Director or the Data Subject, will be deemed to be defrauding their duties. Violating personal rights and causing damage to another person is considered a serious offense and may be punished to the point of dismissal without paying compensation. Any
2. Employees at Demco Assign the responsibility of controlling data, storing, maintaining, and processing. If they commit an offense themselves, they will be considered and punished at a higher rate than ordinary employees.
3. Employees who do not submit personal information to Demco Requesting or providing false information is considered a dereliction of duty with the intention of causing damage to Demco.
4. Any employee who violates or fails to comply with the policy. This Protocol If any damage occurs, The employee must pay full compensation for the damage as required by law.

Demco Therefore, all employees are requested to study and strictly comply with the above policies and guidelines so that their personal information is collected. Maintain and use safely at all times working together forever.