ကိုယ်ရေးအချက်အလက်မူဝါဒ

FOR TRADING PARTNERS

PERSONAL DATA PRIVACY NOTICE

RMA GROUP CO., LTD.

FOR TRADING PARTNERS

This personal data privacy notice (“Privacy Notice”) intends to clarify how we handle the information we receive from you, the purposes for the collection, use, and disclosure, the retention period of such Personal Data, as well as your rights as the data subject with regard to your access, use, and correction of your Personal Data.

This Privacy Notice only applies to the use of your Personal Data obtained by us, whether from you directly or from a third party. It does not apply to Personal Data collected by third parties during your communications with those third parties or your use of their products or services.

Definitions

“Personal Data”	means information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection.
“Personal Data Protection Laws”	means the Personal Data Protection Act B.E. 2562 (2019) and its relevant subordinate laws, including any amendments which may be made thereto in the future.
“Process” or “Processes” or “Processing”	means any operation, whether or not by automated means, performed on Personal Data, such as collection, recording, organization, storage, adaptation or alteration, retrieval, use, disclosure (by transfer, dissemination or otherwise making available), alignment, combination, restriction, erasure or destruction.
“RMA” or “we” or “us” or “our”	means RMA Group Co., Ltd., together with other members and businesses of its group.^[1]
“Website”	means the website and/or applications serviced by us as the case may be.

About RMA

RMA Group Co., Ltd. is a juristic person established under the law of Thailand with the principal office address at 283/74 Home Place Office Building, 15th Floor, Soi Sukhumvit 55 (Thonglor 13), Sukhumvit Road, Klongton-Nue, Wattana, Bangkok 10110 Thailand.

RMA Group has an operational presence in 14 countries globally. RMA is the partner of choice for leading automotive, equipment, services and food brands in Southeast Asia and beyond.

Our core operations are automotive retail, manufacturing and parts distribution, fleet management, sales and distribution of heavy equipment, power generation as well as food franchises and engineering services. RMA Automotive manufacturing and modification plants are situated in Turkey, South Africa, Myanmar, Australia. Ford Global Fleet Sales has offices in the US and Dubai.

For more information on RMA Group Co., Ltd., and each member of RMA Group, please visit: www.rmagroup.net

Categories of persons from whom we collect Personal Data

Under this Privacy Notice, we collect and Process Personal Data from the following categories of persons:

Prospective trading partners/vendors: persons who may become our trading partner or vendor, such as middlemen, service providers, consultants, experts, those who will engage in franchise or dealership businesses, contracting parties, those interested in participating in a business project, or any other persons with similar characteristics, from a declaration of intent to enter into a contract with us and/or register as our trading partner or vendor.

Trading partners/vendors: persons who provide quotations for products and/or services to be sold to us, have registered as trading partners or vendors with us, or have relationships of a similar nature with us, such as middlemen, service providers, consultants, experts, those who will engage in franchise businesses, contracting parties, those interested in participating in a business project, or any other persons with similar characteristics.

Persons related to prospective or existing trading partners/vendors: natural persons who are related to or are representatives of trading partners or vendors, such as executives, directors, employees, representatives or personnel of trading partners or vendors who are juristic persons, including persons whose Personal Data appear in relevant documents and processes, such as managers, purchasers, consignees and cheque payers.

How do we collect and receive your Personal Data?

We collect and receive your Personal Data via the following methods:

(a) Personal Data you directly provide to us

You may directly provide your Personal Data to us. This usually occurs when you communicate with us (for instance, delivering documents to us, entering into a contract with us, making enquiries or providing comments or feedback), whether orally or in writing, through the Website, by telephone, email, fax, mail, face-to-face interaction or any other means.

(b) Personal Data we automatically collect from you

We may automatically collect some technical information related to your devices, activities, usage patterns and browsing history, by using log files or other similar technologies.

We may, from time to time and where permitted by law, receive your Personal Data from third parties. This may include:

information shared between our affiliates;
publicly available information from sources such as newspapers, blogs, social media websites and commercial websites; and
sources containing information relating to your business or trades.

In collecting your Personal Data, you will be informed of details set out in this Privacy Notice, including but not limited to the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Personal Data Protection Laws require your consent, we will request your explicit consent in order to Process your Personal Data.

What information about you do we collect?

We may collect and Process your Personal Data that was directly provided by you, automatically collected form you from your use of our services, or was provided to us by third parties.

Such collected Personal Data include the following:

(a) Personal Data such as first name, last name, date/month/year of birth, age, sex, national identification number, photograph, signature, and nationality.

(b) Contact details such as address, telephone number, fax number, e-mail, LINE ID, and details of relevant contact person.

(c) Business information such as details concerning the company or business, including name, registration number, location, and details of relevant contact person.

(d) Information concerning sale and purchase transaction such as vendor code, product and/or order details, details of product complaints, delivery details, tracking number.

(e) Information used as supporting evidence in trading partner/vendor registration or execution of transactions with us such as Personal Data which appears in a copy of national identification card, copy of passport/visa/work permit, copy of house registration book, copy of change of name certificate, copy of driving license, copy of vehicle registration manual, car number plate, type of car, copy of title deed, power of attorney, copy of company affidavit, copy of company affidavit, invoice, receipt, cheque, payment voucher, copy of professional or business license, sale and purchase agreement or any other agreements relating to the transaction or delivery order.

(f) Technical information such as information that we collect through the use of log files (IP addresses, browser type, ISP, date/time stamp, referring/exit pages, number of clicks) or similar technologies, computer traffic data, system access statistics, access time, search history, use of functions in systems.

(g) Other information such as behavior or trends in purchasing products and/or using services, voice recordings, photo and video recordings from CCTV footages, among others.

Personal Data collected or used before 1 June 2022

(a) If we have collected your Personal Data before 1 June 2022, we will continue to collect and/or use such Personal Data in accordance with the purposes for which the Personal Data was originally collected and/or used in accordance with the Personal Data Protection Laws.

(b) If you do not wish for us to continue collecting and/or using your Personal Data, we will prepare and announce a consent withdrawal method to facilitate you. However, we reserve the right to consider your consent withdrawal request and to proceed in accordance with the Personal Data Protection Laws.

Purposes of Collection, Use, Disclosure and Processing

We may Process your Personal Data for the following purposes (collectively, the “Purposes”):

No.	Purpose	Lawful Basis of the Processing
(a)	To comply with the duties under relevant laws and regulations applicable to us, our business and/or our services, and legitimate orders of government agencies and relevant officers.	The Processing of your Personal Data is necessary for the compliance of our duties in accordance with relevant laws and regulations that are enforceable on us, such as taxation law, Personal Data Protection Laws, and legitimate orders of government agencies and relevant officers, such as the Office of the Personal Data Protection Commission.
(b)	For the purpose of establishment, compliance, exercise or defense of our legal claims.	The Processing of your Personal Data is necessary for our legitimate interests or those of other persons or juristic persons in the establishment, compliance, exercise or defense of our legal claims, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court.
(c)	For purposes relating to selling our products and/or other relevant transactions, such as: – Vendor registration and account opening; – Entering into agreements for sale and purchase of products and/or services; – Management and fulfilment of orders, preparation of products and/or services; – Processing payments of products and/or services.	The Processing of your Personal Data is necessary for: – The entry into and performance of contracts and agreements or other relevant processes, such as checking of evidence for entry into agreements, consideration of credit limit, and to act in accordance with vendor’s request in respect of new vendor account opening; or – our legitimate interests in our business operations, such as management of account and verification of the identity of the vendor, consideration of qualifications of the vendor, etc.
(d)	To provide sales-related services, such as: – Dealing with your inquiries and requests; – Corresponding with you; – Providing general administration and troubleshooting services to you.	The Processing of your Personal Data is necessary for our legitimate interests in facilitating trading partners or vendors, persons related to the trading partners or vendors, or any other persons with similar characteristics in providing sales-related services.
(e)	For the purposes of promoting our business operations and managing our relationship with you, such as: – Inform you of relevant updates, promotions or events; – Manage our relationship with you; – Administer loyalty programs; – Invite you to participate in market research campaigns or surveys; – Develop marketing strategies; – Administer marketing campaigns.	The Processing of your Personal Data is necessary for our legitimate interests or those of other persons or juristic persons to manage our relationship with you and inform you of our business, products and events.
(f)	For the purposes of promoting our business operations and managing our relationship with you, such as: – Providing you with information about and managing our affiliates, relevant promotions, products and services, outlets, events, and to develop and improve such purposes.	The Processing of your Personal Data is necessary for our legitimate interests or those of other persons or juristic persons to inform you of our affiliates and relevant promotions, events products or services.
(g)	For the purposes of general business administration, such as: – Business record keeping; – Organizational management; – Management of contractor lifecycle (from hiring to departure); – Administering and running events, training, and programs; – IT systems development, implementation, operation and maintenance; – Security maintenance of systems, devices, and buildings; – Operating and maintaining a safe work environment; – Ensuring the security and safety of our affiliates’ staff, customers, vendors, suppliers, and visitors.	The Processing of your Personal Data is necessary for our legitimate interests or those of other persons or juristic persons to manage our business operations, our relationship with you, and maintaining the security of our personnel, buildings, infrastructure and systems.
(h)	For the purposes of security and systems monitoring and protection, such as: – Authentication and access controls and logs; – Monitoring of our systems, devices, internet; – Monitoring of access to our premises, deliveries to our affiliates, and security-related processes at our premises	The Processing of your Personal Data is necessary for our legitimate interests or those of other persons or juristic persons in ensuring the confidentiality, integrity and security of our physical and digital infrastructure and premises.
(i)	For the purposes of any transaction that is necessary and beneficial to you directly or to support the above purposes, such as: – Administering your accounts; – Managing your appointments with us; – Enhancing your experiences; – Providing administration and troubleshooting services to you.	The Processing of your Personal Data is necessary for our legitimate interests in carrying out any transactions which are necessary for us and/or beneficial to you or directly related to the purposes set forth above.
(j)	For procedures and processes relating to or arising from any of the purposes set forth above.	The Processing of your Personal Data is necessary for our legitimate interests in carrying out any procedures necessary for our business operations or directly related to any of the purposes set forth above. Where the Personal Data Protection Laws require your consent for any Processing of your Personal Data, we will ask for your explicit consent.

Insofar as the Personal Data which we will Process for the Purposes relates to and is necessary for the compliance with applicable laws or the entry into or performance of contracts with you, if you do not provide such Personal Data to us, there may be legal implications or we may not be able to enter into or perform our duties under the contract (as the case may be). In such event, it may be necessary for us to decline to enter into the contract with you, or to cancel the sale and purchase, or the provision of any relevant services to you, whether in part or in whole.

Where we rely on your consent to process your Personal Data, you will have the right to withdraw it at any time, unless there is a restriction of the withdrawal of consent by law, or the contract which gives benefits to you. The withdrawal of your consent will not affect the lawfulness of processing based on consent before such withdrawal.

If we Process your Personal Data in a manner and/or for purposes inconsistent with the aforementioned Purposes, we will put in place additional policies or notifications for protection of the Personal Data and/or send you a notice explaining our Processing of the Personal Data. In this regard, we encourage that any additional policies or notifications be reviewed and read together with this Privacy Notice.

Disclosure of Personal Data

We may disclose your Personal Data in accordance with the Purposes and the rules prescribed under applicable laws to the following entities and persons:

(a) Our affiliated companies, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.

(b) Business partners, service providers, and data processors designated or hired by us to perform duties in connection with the management and/or Processing of Personal Data for us to provide services in areas such as information technology, data analytics, delivery, printing, health, insurance, training, research, marketing, or others which may be beneficial to you or our business operations.

(d) Relevant governmental agencies with supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers relevant to the legal process or which were granted permission pursuant to applicable laws.

(e) Any other persons or entities to whom you have given consent for disclosure of Personal Data.

Any disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by applicable laws, and if the law requires your consent, we will request your prior consent to any such disclosure.

If we disclose your Personal Data to third parties, we will put in place appropriate safeguards to protect the disclosed Personal Data and comply with standards and duties relating to the protection of Personal Data as prescribed by the Personal Data Protection Laws. Where we send or transfer your Personal Data outside Thailand, we will ensure that the recipient country, international organization, entity or any such overseas recipient has a sufficient standard of protection of Personal Data.

Retention Period

We will retain your Personal Data as long as necessary to fulfil the Purposes for which the Personal Data was collected, or any other period prescribed under applicable laws (including but not limited to Personal Data Protection Laws). To this end, we will consider the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the Personal Data we collect, as well as our business practices in relation to each category of Personal Data in order to provide our services to you.

In this regard, we will retain your Personal Data for no longer than 10 years from the date your legal relations and/or transactions with us come to an end. However, we may continue to retain such Personal Data for a longer period if applicable laws permit or such retention is necessary to establish our right of claim.

After the retention period (or longer period as applicable laws permit) expires, we will delete, destroy or anonymize the Personal Data from our system and records, as well as those of any other persons providing services to us.

Should you have any other questions or require any additional details regarding the retention period of your Personal Data, please contact us via the contact details set out in this Privacy Notice.

Your rights with regard to your Personal Data

As the data subject, you have the following legal rights with regard to the Personal Data we collect from you, subject to the rules, methods and conditions under Personal Data Protection Laws:

Right of Access

You have the right to access your Personal Data and may request that we provide you with a copy of such Personal Data in accordance with the requirements of the Personal Data Protection Laws.

Right to Data Portability

You have the right to obtain your Personal Data, including to request that your Personal Data be transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements of Personal Data Protection Laws.

Right to Object

You have the right to object to the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Erasure

You have the right to request that we delete, destroy or anonymize your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Restriction

You have the right to request that we restrict the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Rectification

You have the right to request that your Personal Data be rectified if your Personal Data is inaccurate, incomplete, not up-to-date, or may cause misunderstanding.

Right to Withdraw Consent

If we rely on your consent as the lawful basis for our Processing of your Personal Data, you have the right to withdraw such consent at any time.

Right to Lodge a Complaint

If you have reason to believe that we are in breach of Personal Data Protection Laws, you have the right to lodge a complaint to the data protection supervisory authority, in accordance with the rules, methods and conditions prescribed under the Personal Data Protection Laws.

If you wish to make a request to exercise your rights, or have any questions or concerns about any aspect of our practices with regard to your Personal Data, you may contact us via our contact details in this Privacy Notice.

We reserve the right to consider your request to exercise your rights and act in accordance with the requirements under Personal Data Protection Laws.

Contact Us

If you have any questions in relation to this Privacy Notice, or would like to exercise your rights as set out in this Privacy Notice, please kindly use the contact form published on www.rmagroup.net.

You may also contact us through our Compliance Department via the following details:

E-mail	:	compliance@rmagroup.net
Telephone number	:	+66 2 762 8500
Mailing address	:	283/74 Home Place Office Building, 15th Floor, Soi Sukhumvit 55 (Thonglor 13), Sukhumvit Road, Klongton-Nue, Wattana, Bangkok 10110 Thailand

Applicable Law

This Privacy Notice shall be governed by and construed in accordance with the laws of Thailand. Thai courts shall have exclusive jurisdiction over any dispute that may arise out of or in connection with this Privacy Notice.

Changes to this Privacy Notice

To the extent permitted by law, we reserve the right to partly or fully amend or change this Privacy Notice, or simply to update its content, at any time and at our discretion. We may also make changes as required for compliance with change in applicable laws or regulatory requirements. Therefore, we encourage you to review the Privacy Notice whenever you access or use our services or otherwise interact with us to stay informed about our privacy practices and the ways you can protect your privacy.

This Privacy Notice shall be effective from 1 June 2022.

[1] RMA Group includes any one or more of the following juristic entities: (1) RMA Group Co., Ltd.; (2) R.M.A. Trading Company Limited; (3) Mazda City Company Limited; (4) City Automobiles Company Limited; (5) RMA City Motors Co., Ltd.; (6) Global Armor (Thailand) Co., Ltd.; (7) Global Fleet Sales (Thailand) Co., Ltd.; (8) RMA Automotive Co., Ltd., (9) Express Food Group (Thailand) Co., Ltd.; and/or (10) Express Food Group Co., Ltd.

FOR CANDIDATES AND PERSONNEL

PERSONAL DATA PRIVACY NOTICE

RMA GROUP CO., LTD.

FOR CANDIDATES AND PERSONNEL

Definitions

“Personal Data”	means information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection.
“Personal Data Protection Laws”	means the Personal Data Protection Act B.E. 2562 (2019) and its relevant subordinate laws, including any amendments which may be made thereto in the future.
“Process” or “Processes” or “Processing”	means any operation, whether or not by automated means, performed on Personal Data, such as collection, recording, organization, storage, adaptation or alteration, retrieval, use, disclosure (by transfer, dissemination or otherwise making available), alignment, combination, restriction, erasure or destruction.
“RMA” or “we” or “us” or “our”	means RMA Group Co., Ltd., together with other members and businesses of its group.^[1]

About RMA

RMA Group has an operational presence in 14 countries globally. RMA is the partner of choice for leading automotive, equipment, services and food brands in Southeast Asia and beyond.

For more information on RMA Group Co., Ltd., and each member of RMA Group, please visit: www.rmagroup.net

Categories of persons from whom we collect Personal Data

Under this Privacy Notice, we collect and Process Personal Data from the following categories of persons:

Job applicants/candidates: persons who may be selected to be our personnel, upon which we will collect Personal Data from such persons directly or from third parties.

Personnel: persons who work or perform any duties for us and receive wages, welfare benefits, or any other form of compensation (regardless of what such form of compensation is called) from us, such as directors, executives, managers, employees, personnel, trainees or any other persons with similar characteristics, but not including contractors or service providers who are our business or trading partners or vendors.

Persons related to job applicant/candidates and personnel: persons who are related to our job applicants or candidates and personnel, including persons whose Personal Data appear in relevant documents and processes, such as family members (father, mother, spouse, children, etc.), emergency contact persons, reference persons, beneficiaries, guarantors, etc.

How do we collect and receive your Personal Data?

We collect and receive your Personal Data via the following methods:

(a) Personal Data you directly provide to us

You may directly provide your Personal Data to us. This usually occurs when you submit job application forms and supporting documents to us, whether by walk-ins at our premises, job fairs, online through our Website, during job interviews, or when you enter into a contract with us and submit documents containing your Personal Data to us.

(b) Personal Data we automatically collect from you

We may collect some technical information related to your devices, activities, usage patterns and browsing history, by using automated means such as log files or other similar technologies.

We may receive your Personal Data from third parties, such as job board websites, your reference persons, recruitment companies, government agencies, educational institutions, social media platforms, job application forms, or documents of persons related to you (such as family members), emergency contact persons, reference persons, or beneficiaries.

What information about you do we collect?

We may collect and Process your Personal Data that was directly provided by you, automatically collected form you from your use of our services, or was provided to us by third parties.

Such collected Personal Data include the following:

(a) Personal Data such as first name, last name, date/month/year of birth, age, sex, national identification number, photograph, signature, nationality, race, religion, marital status, military status, details of family members (such as father, mother, spouse, children, etc.), health conditions, and biometric data (such as fingerprint recognition data, facial recognition data, etc.).

(b) Contact details such as address, telephone number, fax number, e-mail, LINE ID, and details of emergency contact persons and reference persons, etc.

(c) Information on education and training such as academic background (such as institution name, faculty, program, year of graduation, etc.), academic certificate, transcript, language skills, computer skills, training and examination details, extracurricular activities during the course of study, etc.

(d) Job application information such as working experience, details in resume or CV, position applied for, expected salary, interview details, supporting documents, details in interview assessment forms (such as assessment results, knowledge and experience, personal characteristics, leadership or teamwork abilities, interpersonal skills, etc.).

(e) Supporting information on job application or execution of juristic acts, namely Personal Data appearing in documents such as copy of national identification card, copy of passport, copy of change of name certificate, copy of house registration book, copy of military service certificate, copy of bank account book, copy of birth certificate, copy of marriage certificate, approval form for salary of new and monthly staff, medical certificate, results of pre-employment medical check-up, beneficiary form, social security application form, letter of consent for personal background check, results of personal background check, employment contract and relevant documents thereof (such as letter of guarantee for performance of employment contract, certificate of employment specifying job position and salary, copy of civil servant card, etc.), directorship agreement, power of attorney, etc.

(f) Work and assessment information such as personnel code, position, department, affiliation, chain of command, performance assessment, accomplishments or awards received, training information, disciplinary action information, details in personnel transfer documents, letter of resignation, etc.

(g) Information on benefit and remuneration such as salary, wages, bonus, pension details, welfare, bank account number, guarantor details, beneficiary details, social security details, provident fund details, tax details, tax deduction details, health benefit details (including for family members), medical certificates, annual health reports, maternity leave forms, salary reduction consent letters, receipts, invoices, compensation request forms (such as for life insurance), retirement benefit request form, etc.

(h) Statistical information such as starting date, probation end date, working date, hours of work, hours of overtime, annual leave, leave date, leave form, details of leave (including reasons for leave), record of use of our systems, etc.

(i) Technical information such as information that we collect through the use of log files (IP addresses, browser type, ISP, date/time stamp, referring/exit pages, number of clicks) or similar technologies, computer traffic data, system access statistics, access time, search history, use of functions in systems.

(j) Other information such as voice recordings, photo and video recordings from CCTV footages, among others.

Personal Data collected or used before 1 June 2022

Purposes of Collection, Use, Disclosure and Processing

We may Process your Personal Data for the following purposes (collectively, the “Purposes”):

No.	Purpose	Lawful Basis of the Processing
(a)	To comply with the duties under relevant laws and regulations applicable to us, our business and/or our services (such as laws relating to human resource management), and legitimate orders of government agencies and relevant officers.	The Processing of your Personal Data is necessary for the compliance of our duties in accordance with relevant laws and regulations that are enforceable on us, such as labor laws, social security laws, taxation laws, securities and exchange laws, Personal Data Protection Laws, and legitimate orders of government agencies and relevant officers, such as the Revenue Department, Social Security Office, Department of Empowerment of Persons with Disabilities, Department of Skill Development, etc.
(b)	For the purpose of establishment, compliance, exercise or defense of our legal claims.	The Processing of your Personal Data is necessary for our legitimate interests in the establishment, compliance, exercise or defense of our legal claims, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court.
(c)	For purposes related to application verification and candidate examination, such as: – Verifying employment history, qualifications, experience and references; – Conducting candidate background screening	The Processing of your Personal Data is necessary for: – The compliance of our duties in accordance with relevant laws and regulations to employ eligible and suitable people; – Our legitimate interests in the relevant stages of the recruitment process, and consideration of qualifications and role eligibility.
(d)	For purposes related to recruitment and selection, such as: – Performing recruitment and selection, including interviews, assessments, psychometric profiling, shortlisting, job offer and benefits; – Reviewing application forms and online assessments and skills tests; – Shortlisting candidates; – Conducting group, panel and/or individual interviews; – Informing candidates of interview and selection outcomes; – Record keeping and monitoring.	The Processing of your Personal Data is necessary for our legitimate interests in recruiting and selecting candidates who are eligible and suitable for the relevant roles available with us, and keeping and maintaining records of the recruitment process.
(e)	For purposes related to pre-employment management processes, such as: – Preparing, issuing and arrangement for signing of employment contract; – Establishing an electronic personal records and files; – Creating payroll records; – Enrolling new employee benefits; – Reporting commencement of employment to relevant legal authorities.	The Processing of your Personal Data is necessary for our legitimate interests in preparing necessary employment documents and contracts and completing our internal records.
(f)	For the purposes of general business administration, such as: – Business record keeping; – Organizational management; – Management of employee lifecycle (from hiring to departure); – Administering and running events, training, and programs; – Correspondences in relation to your employment, position and role, including handling your inquiries and requests; – IT systems development, implementation, operation and maintenance; – Security maintenance of systems, devices, and buildings; – Talent acquisition and management; – Benefits management and administration; – Operating and maintaining a safe work environment; – Ensuring the security and safety of our affiliates’ staff, customers, vendors, suppliers, and visitors; – Administration and management of insurance schemes, including sharing your information with third-party pensions and insurance providers.	The Processing of your Personal Data is necessary for our legitimate interests in our business operations, our relationship with you, and management of employee and record keeping arrangements.
(g)	For the purposes of general employment administration, such as: – Processing of your information in relation to your employment or application, including identification documents (such as identification cards or passports), social insurance and personal income tax data; – Administration of payroll, compensation, welfare, benefits, recognition and awards; – Time and attendance management (including leave of absence); – Administration of occupational health, medical examinations and drug or alcohol testing; – Compliance with collective agreements.	The Processing of your Personal Data is necessary for: – the entry into and performance of contracts and agreements or other relevant processes and to discharge our contractual obligation with you as our personnel; – where there is no contractual obligation, our legitimate interests to administer and manage our relationship with you and, where applicable, to understand your particular circumstances that may inhibit your ability to work.
(h)	For purposes related to personnel transfer and secondment.	The Processing of your Personal Data is necessary for: – Our performance of our contractual obligations under the relevant contracts and agreements such as the employment contract, personnel transfer agreement, or any other similar or relevant contracts; – Our legitimate interests in the human resources management of our business operations in relation to personnel transfer. To this end, where we send or transfer any Personal Data of our personnel to a foreign country, we will ensure that the destination country that receives such Personal Data has adequate data protection standards in place.
(i)	For the purposes of security and systems monitoring and protection, such as: – Authentication and access controls and logs; – Monitoring of our systems, devices, internet; – Monitoring of access to our premises, deliveries to our affiliates, and security-related processes at our premises	The Processing of your Personal Data is necessary for our legitimate interests in ensuring the confidentiality, integrity and security of our physical and digital infrastructure and premises.
(j)	For the purposes of compliance with our policies on remediation, disciplinary action, grievances, and dismissal, such as: – Conducting fair disciplinary, grievance and dismissal processes; – Monitoring compliance with our policies; – Investigating policy non-compliance, incidents, issues, disciplinary actions and grievances; – Managing remediation of non-compliance with policies.	The Processing of your Personal Data is necessary for: – Our performance of our contractual obligations to you as an employer; – Where there is no contractual obligation, our legitimate interests in managing compliance with our policies, as well as grievances and disciplinary matters.
(k)	For procedures and processes relating to or arising from any of the purposes set forth above.	The Processing of your Personal Data is necessary for our legitimate interests in carrying out any procedures necessary for our business operations or directly related to any of the purposes set forth above. Where the Personal Data Protection Laws require your consent for any Processing of your Personal Data, we will ask for your explicit consent.

Insofar as the Personal Data which we will Process for the Purposes relates to and is necessary for the compliance with applicable laws or the entry into or performance of contracts with you, if you do not provide such Personal Data to us, there may be legal implications or we may not be able to enter into or perform our duties under the contract (as the case may be). In such event, it may be necessary for us to decline to enter into the contract with you, or the provision of any relevant services to you, whether in part or in whole.

Disclosure of Personal Data

We may disclose your Personal Data in accordance with the Purposes and the rules prescribed under applicable laws to the following entities and persons:

(a) Our affiliated companies, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.

(e) Any other persons or entities to whom you have given consent for disclosure of Personal Data.

Retention Period

Should you have any other questions or require any additional details regarding the retention period of your Personal Data, please contact us via the contact details set out in this Privacy Notice.

Your rights with regard to your Personal Data

As the data subject, you have the following legal rights with regard to the Personal Data we collect from you, subject to the rules, methods and conditions under Personal Data Protection Laws:

Right of Access

You have the right to access your Personal Data and may request that we provide you with a copy of such Personal Data in accordance with the requirements of the Personal Data Protection Laws.

Right to Data Portability

Right to Object

You have the right to object to the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Erasure

You have the right to request that we delete, destroy or anonymize your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Restriction

You have the right to request that we restrict the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Rectification

You have the right to request that your Personal Data be rectified if your Personal Data is inaccurate, incomplete, not up-to-date, or may cause misunderstanding.

Right to Withdraw Consent

If we rely on your consent as the lawful basis for our Processing of your Personal Data, you have the right to withdraw such consent at any time.

Right to Lodge a Complaint

We reserve the right to consider your request to exercise your rights and act in accordance with the requirements under Personal Data Protection Laws.

Contact Us

You may also contact us through our Compliance Department via the following details:

E-mail	:	compliance@rmagroup.net
Telephone number	:	+66 2 762 8500
Mailing address	:	283/74 Home Place Office Building, 15th Floor, Soi Sukhumvit 55 (Thonglor 13), Sukhumvit Road, Klongton-Nue, Wattana, Bangkok 10110 Thailand

Applicable Law

Changes to this Privacy Notice

This Privacy Notice shall be effective from 1 June 2022.

FOR CUSTOMERS

PERSONAL DATA PRIVACY NOTICE

RMA GROUP CO., LTD.

FOR CUSTOMERS

Definitions

“Personal Data”	means information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection.
“Personal Data Protection Laws”	means the Personal Data Protection Act B.E. 2562 (2019) and its relevant subordinate laws, including any amendments which may be made thereto in the future.
“Process” or “Processes” or “Processing”	means any operation, whether or not by automated means, performed on Personal Data, such as collection, recording, organization, storage, adaptation or alteration, retrieval, use, disclosure (by transfer, dissemination or otherwise making available), alignment, combination, restriction, erasure or destruction.
“RMA” “we” or “us” or “our”	means RMA Group Co., Ltd., together with other members and businesses of its group.^[1]
“Website”	means the website and/or applications serviced by us as the case may be.

About RMA

RMA Group has an operational presence in 14 countries globally. RMA is the partner of choice for leading automotive, equipment, services and food brands in Southeast Asia and beyond.

Our core operations are automotive retail, manufacturing and parts distribution, fleet management, sales and distribution of heavy equipment, power generation as well as food franchises and engineering services. RMA Automotive manufacturing and modification plants are situated in Turkey, South Africa, Myanmar, and Australia. Ford Global Fleet Sales has offices in the US and Dubai.

For more information on RMA Group Co., Ltd., and each member of RMA Group, please visit: www.rmagroup.net

Categories of persons from whom we collect Personal Data

Under this Privacy Notice, we collect and Process Personal Data from the following categories of persons:

Customers: persons who purchase our products and/or use our services, and/or prospective customers who are expected to purchase our products and/or use our services, or any other persons with similar characteristics, such as persons who participate in activities, seminars, bids, Website users, persons who contact us to receive information or services from us, persons who respond to surveys on our products and/or services, as well as juristic persons and persons whose Personal Data appear in the relevant documents and processes.

Persons related to customers: persons who are related to or are representatives of customers, such as executives, directors, employees, representatives or personnel of customers who are juristic persons, including persons whose Personal Data appear in relevant documents and processes, such as managers, purchasers, consignees and cheque payers.

How do we collect and receive your Personal Data?

We collect and receive your Personal Data via the following methods:

(a) Personal Data you directly provide to us

You may directly provide your Personal Data to us. This usually occurs when you:

· communicate (for instance, making enquiries or providing comments or feedback) with us, whether orally or in writing, through the Website, by telephone, email, fax, mail, face-to-face interaction or any other means;

· express an intention to purchase our products or use our services (such as by registering to be a member of our databases), enter into a contract with us or deliver documents containing your Personal Data to us; and

· participate in lucky draws, attend marketing events or engage in other marketing activities organized by us or on our behalf.

(b) Personal Data we automatically collect from you: we may automatically collect some technical information related to your devices, activities, usage patterns and browsing history, by using log files or other similar technologies.

(c) Personal Data we receive from third parties: we may, from time to time and where permitted by law, receive your Personal Data from third parties. This may include:

· information shared between our affiliates;

· publicly available information from sources such as newspapers, blogs, social media websites and commercial websites; and

· marketing lists from third-party agencies or data aggregators.

What information about you do we collect?

We may collect and Process your Personal Data that was directly provided by you, automatically collected form you from your use of our services, or was provided to us by third parties.

Such collected Personal Data include the following:

(a) Personal Data such as first name, last name, date/month/year of birth, age, sex, national identification number, photograph, signature, and nationality.

(b) Contact details such as address stated on national identification card, address stated in house registration book, delivery address, billing address, telephone number, fax number, e-mail, LINE ID, and emergency contact information.

(c) Customer business information such as details concerning the customer’s factory or business, including name, registration number, location, and contact details.

(d) Information concerning sale and purchase transaction such as customer code, vendor code, order details, details of product complaints, delivery details, tracking number.

(e) Payment information such as monetary amount, credit limit, payment terms, account number, Personal Data appearing in tax invoice, cheque, payment voucher, and receipt.

(f) Information used as supporting evidence in customer registration forms or execution of transactions with us such as Personal Data which appears in a copy of national identification card, copy of passport/visa/work permit, copy of house registration book, copy of change of name certificate, copy of customer account opening form, documents certifying non-related parties, power of attorney, copy of company affidavit, security documents (title deeds, bank guarantees, or personal guarantees), sale and purchase agreement or any other agreements relating to the transaction or delivery order.

(g) Technical information such as information that we collect through the use of log files (IP addresses, browser type, ISP, date/time stamp, referring/exit pages, number of clicks) or similar technologies, computer traffic data, system access statistics, access time, search history, use of functions in systems.

(h) Other information such as behavior or trends in purchasing products and/or using services, voice recordings, photo and video recordings from CCTV footages, among others.

Personal Data collected or used before 1 June 2022

Purposes of Collection, Use, Disclosure and Processing

We may Process your Personal Data for the following purposes (collectively, the “Purposes”):

No.	Purpose	Lawful Basis of the Processing
(a)	To comply with the duties under relevant laws and regulations applicable to us, our business and/or our services, and legitimate orders of government agencies and relevant officers.	The Processing of your Personal Data is necessary for the compliance of our duties in accordance with relevant laws and regulations that are enforceable on us, such as taxation law, Personal Data Protection Laws, and legitimate orders of government agencies and relevant officers, such as the Office of the Personal Data Protection Commission.
(b)	For the purpose of establishment, compliance, exercise or defense of our legal claims.	The Processing of your Personal Data is necessary for our legitimate interests in the establishment, compliance, exercise or defense of our legal claims, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court.
(c)	For purposes relating to selling our products and/or services to customers and other relevant transactions, such as: – Membership registration or customer account opening; – Entering into agreements for sale and purchase of products and/or services; – Management and fulfilment of customer orders, preparation of products and/or services; – Processing payments of products and/or services.	The Processing of your Personal Data is necessary for: – The entry into and performance of contracts and agreements or other relevant processes, such as checking of evidence for entry into agreements, consideration of credit limit, and to act in accordance with customer’s request in respect of new customer account opening; – our legitimate interests in our business operations, such as management of account and verification of the identity of customers, consideration of qualifications of customers, etc.
(d)	To provide sales-related services, such as: – Dealing with your inquiries and requests; – Corresponding with you; – Providing general administration and troubleshooting services to you; – Administering loyalty programs.	The Processing of your Personal Data is necessary for our legitimate interest in facilitating customers, persons related to the customers, or any other persons with similar characteristics in providing sales-related services.
(e)	To engage in marketing communications, public relations and other similar activities, such as: – Contacting you via telephone call, short messages service (SMS), e-mail, mail or via any contact channels in order to ask, inform, verify or confirm your account information, conducting surveys; – Keeping you updated on any news related to our organization and services; – Keeping records of photographs, footages and/or audio recordings (if any) during events involving public relations and marketing activities.	Where we proceed with any marketing activities, such as sending marketing messages to customers, or taking photographs and videos of customers to process and publicize marketing communications, we will undertake such activities by relying on the consent received from you. We will send you marketing communication messages only when you subscribe to receive marketing communication or when you have given explicit consent to receive such marketing communications.
(f)	To perform data analytics and improve the quality of our products and/or services for you, in order to respond to your service requests, inquiries, or suggestions, and to ensure that we are providing you our services efficiently, such as: – Analyzing and surveying customer behavior or purchasing Personal Data of the customer from third parties to use such Personal Data for analysis and survey of customer behavior; – Managing your relationship with us; – Analyzing your use of our services, Websites or other media.	The Processing of your Personal Data from your use of our Website or other media is necessary for: – our legitimate interests in our business operations and improvement of the quality of our products and/or services; or – in the event that we collect and Process your Personal Data to analyze and advertise products and/or services based on your behavior, or conduct marketing campaigns directly to you, or where Personal Data Protection Laws require your consent, we will rely on the consent received from you in undertaking such actions.
(g)	For the purposes of any transaction that is necessary and beneficial to you directly or to support the above purposes, such as: – Administering your accounts; – Managing your appointments with us; – Enhancing your experiences; – Providing administration and troubleshooting services to you.	The Processing of your Personal Data is necessary for our legitimate interests in carrying out any transactions which are necessary for us and/or beneficial to you or directly related to the purposes set forth above.
(h)	For procedures and processes relating to or arising from any of the purposes set forth above.	The Processing of your Personal Data is necessary for our legitimate interests in carrying out any procedures necessary for our business operations or directly related to any of the purposes set forth above. Where the Personal Data Protection Laws require your consent for any Processing of your Personal Data, we will ask for your explicit consent.

Disclosure of Personal Data

We may disclose your Personal Data in accordance with the Purposes and the rules prescribed under applicable laws to the following entities and persons:

(a) Our affiliated companies, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.

(e) Any other persons or entities to whom you have given consent for disclosure of Personal Data.

Retention Period

Should you have any other questions or require any additional details regarding the retention period of your Personal Data, please contact us via the contact details set out in this Privacy Notice.

Your rights with regard to your Personal Data

As the data subject, you have the following legal rights with regard to the Personal Data we collect from you, subject to the rules, methods and conditions under Personal Data Protection Laws:

Right of Access

You have the right to access your Personal Data and may request that we provide you with a copy of such Personal Data in accordance with the requirements of the Personal Data Protection Laws.

Right to Data Portability

Right to Object

You have the right to object to the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Erasure

You have the right to request that we delete, destroy or anonymize your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Restriction

You have the right to request that we restrict the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Rectification

You have the right to request that your Personal Data be rectified if your Personal Data is inaccurate, incomplete, not up-to-date, or may cause misunderstanding.

Right to Withdraw Consent

If we rely on your consent as the lawful basis for our Processing of your Personal Data, you have the right to withdraw such consent at any time.

Right to Lodge a Complaint

We reserve the right to consider your request to exercise your rights and act in accordance with the requirements under Personal Data Protection Laws.

Contact Us

You may also contact us through our Compliance Department via the following details:

E-mail	:	compliance@rmagroup.net
Telephone number	:	+66 2 762 8500
Mailing address	:	283/74 Home Place Office Building, 15th Floor, Soi Sukhumvit 55 (Thonglor 13), Sukhumvit Road, Klongton-Nue, Wattana, Bangkok 10110 Thailand

Applicable Law

Changes to this Privacy Notice

This Privacy Notice shall be effective from 1 June 2022.

FOR THE USE OF CCTV CAMERA

PERSONAL DATA PRIVACY NOTICE

RMA GROUP CO., LTD.

FOR THE USE OF CCTV CAMERA

This Privacy Notice shall apply to the processing of your Personal Data obtained by us via our closed-circuit television (“CCTV”) cameras.

Definitions

“Personal Data”	means information which can or may identify you, whether directly or indirectly, according to the Personal Data Protection Laws.
“Personal Data Protection Laws”	means the Personal Data Protection Act B.E. 2562 (2019) and its relevant subordinate laws, including any amendments which may be made thereto in the future.
“Process” or “Processes” or “Processing”	means any operation, whether or not by automated means, performed on Personal Data, such as collection, recording, organization, storage, adaptation or alteration, retrieval, use, disclosure (by transfer, dissemination or otherwise making available), alignment, combination, restriction, erasure or destruction.
“RMA” or “we” or “us” or “our”	means RMA Group Co., Ltd., together with other members and businesses of its group.^{^[1]}

About RMA

RMA Group has an operational presence in 14 countries globally. RMA is the partner of choice for leading automotive, equipment, services and food brands in Southeast Asia and beyond.

For more information on RMA Group Co., Ltd., and each member of RMA Group, please visit: www.rmagroup.net[R&T1]

How do we collect and receive your Personal Data?

We collect your Personal Data via CCTV cameras installed in our facilities and around our premises.

What information about you do we collect?

Through our CCTV cameras, we may collect the following personal data of yours:

(a) Still images;

(b) video recordings;

(d) personal data contained within the CCTV footage.

Purposes of Collection, Use, Disclosure and Processing

We may Process your Personal Data for the following purposes (collectively, the “Purposes”):

No.	Purpose	Lawful Basis of the Processing
(a)	To comply with the duties under relevant laws and regulations applicable to us, our business and/or our services, and legitimate orders of government agencies and relevant officers.	The Processing of your Personal Data is necessary for the compliance of our duties in accordance with relevant laws and regulations that are enforceable on us. For instance, providing CCTV footage to the relevant authorities as required by law or court order.
(b)	For the purpose of establishment, compliance, exercise or defense of our legal claims.	The Processing of your Personal Data is necessary for our legitimate interests in the establishment, compliance, exercise or defense of our legal claims, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court.
(c)	To ensure the security and safety of our staff, customers, vendors, suppliers, and visitors and of our properties and facilities.	The Processing of your Personal Data is necessary for our legitimate interests in security arrangements or your vital interests. For instance, to ensure the safety and security of our properties, facilities, or any person on our premises or to prevent crimes.

If we Process your Personal Data in a manner and/or for purposes inconsistent with the aforementioned Purposes, we will put in place additional policies or notifications for the protection of the Personal Data and/or send you a notice explaining our Processing of the Personal Data. In this regard, we encourage that any additional policies or notifications be reviewed and read together with this Privacy Notice.

Disclosure of Personal Data

We may disclose your Personal Data in accordance with the Purposes and the rules prescribed under applicable laws to the following entities and persons:

(a) Our affiliated companies, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.

(b) Business partners, service providers, and data processors designated or hired by us to perform duties in connection with the management and/or Processing of Personal Data for us to provide services in areas such as information technology, security, or others which may be beneficial to you or our business operations.

(e) Any other persons or entities to whom you have given consent for disclosure of Personal Data.

Retention Period

We will retain your Personal Data for up to 90 calendar days [R&T2] or as long as necessary to fulfil the Purposes for which the Personal Data was collected, or any other period prescribed under applicable laws (including but not limited to Personal Data Protection Laws). To this end, we will consider the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the Personal Data we collect.

Should you have any other questions or require any additional details regarding the retention period of your Personal Data, please contact us via the contact details set out in this Privacy Notice.

Your rights with regard to your Personal Data

As the data subject, you have the following legal rights with regard to the Personal Data we collect from you, subject to the rules, methods and conditions under Personal Data Protection Laws:

Right of Access

You have the right to access your Personal Data and may request that we provide you with a copy of such Personal Data in accordance with the requirements of the Personal Data Protection Laws.

Right to Data Portability

Right to Object

You have the right to object to the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Erasure

You have the right to request that we delete, destroy or anonymize your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Restriction

You have the right to request that we restrict the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Rectification

You have the right to request that your Personal Data be rectified if your Personal Data is inaccurate, incomplete, not up-to-date, or may cause misunderstanding.

Right to Withdraw Consent

If we rely on your consent as the lawful basis for our Processing of your Personal Data, you have the right to withdraw such consent at any time.

Right to Lodge a Complaint

We reserve the right to consider your request to exercise your rights and act in accordance with the requirements under Personal Data Protection Laws.

Contact Us

You may also contact us through our Compliance Department via the following details:

E-mail	:	compliance@rmagroup.net
Telephone number	:	+66 2 762 8500
Mailing address	:	283/74 Home Place Office Building, 15th Floor, Soi Sukhumvit 55 (Thonglor 13), Sukhumvit Road, Klongton-Nue, Wattana, Bangkok 10110 Thailand

Applicable Law

Changes to this Privacy Notice

To the extent permitted by law, we reserve the right to partly or fully amend or change this Privacy Notice, or simply to update its content, at any time and at our discretion. We may also make changes as required for compliance with change in applicable laws or regulatory requirements. Therefore, we encourage you to review the Privacy Notice whenever you access our premises to stay informed about our privacy practices and the ways you can protect your privacy.

This Privacy Notice shall be effective from 1 June 2022.

ကိုယ်ရေးအချက်အလက်မူဝါဒ

Hotline

Yangon Branch

Mandalay Branch

No.G1-B2, Yangon Mandalay Highway Road, Industrial Zone (1), Pyikyi Tagon Township, Mandalay , Myanmar