​

Personal Data Privacy Policy

of

ENVICCO Limited

​

                           ENVICCO Limited (the “Company”, “we” or “our”,) realize the importance of the Personal Data protection and have implemented Personal Data management system consistent with Personal Data Protection law and the related laws. Therefore, the Company would like to notify you of our compliance with Personal Data Protection law as follows: 

                           1. Definition

                           “Personal Data” means any information relating to a person, which enables the identification of such person, whether directly or indirectly, but not including information of deceased persons;

                           “Sensitive Personal Data” means Personal Data pertaining to racial, ethnic origins, political opinions, cult, religious or philosophical beliefs, sexual orientation, criminal records, health data, disability, trade union information, genetic data, biometric data such as fingerprints or facial recognition, or, of any data which may affect the data subjects in the same manner, as prescribed by the Personal Data Protection Committee; and

                           “GC Group” means PTT Global Chemical Public Company Limited and its subsidiaries and affiliates, whether directly or indirectly, that are in the business group of PTT Global Chemical Public Company Limited.

                           2. Collection of Personal Data

The Company may collect your Personal Data as follows:

                           General Personal Data: 

                           (a) Personal Data including, among others, name, surname, date and place of birth, marital status, picture, video recording, signature, electronic signature, information as appeared in Identification Card or passport, copy of Identification Card and Identification Number;

                           (b) contact information including, among others, address, telephone number, LINE ID, contact information on social media identification account, and workplace contact details;

                           (c) security-related information such as CCTV footage and identification of your assets such as vehicles and its registration number in the case of entry to the areas and premises of the Company;

                           (d) work-related information such as job title and position, business or organization you represent or work for, educational background, professional experience and training history;

                           (e) financial information such as bank account number, financial transactions and tax-related documents pertaining to any transaction you may have with the Company;

                           (f) information related to the use of and access to electronic systems relating to the Company including without limitation such email, IP Address, geolocation, browsers, Log file, Cookies inclusive of chat history in various applications and any comment on or reference to the Company or its businesses on the internet or other media;

                           (g) other information provided during your contact or participation in activities relating to the Company inclusive of video recording, photographs, voice recording, comment, feedback, satisfaction and other recommendations related thereto.

                           Sensitive Personal Data:

                           (h) Sensitive Personal Data such as health and disability information, biometric data or behavioral, attitude and aptitude assessment.

                           However, the Company will seek for your consent for the collection and processing of any such Sensitive Personal Data, with the exception of certain cases as prescribed by the Personal Data Protection Act BE 2562 (the “PDPA”).

                           Verification of your identity: The Company hereby inform you that in the event that we are required to request copy(ies) of your personal identification data such as identification card, passport or other documents which may contain Sensitive Personal Data such as religion or blood group, the Company have no intention to collect any such Sensitive Personal Data. Therefore, the Company kindly request that you delete or redact any such Sensitive Personal Data. Otherwise, you authorize the Company to delete or redact such Sensitive Personal Data provided that the relevant personal identification document remains in full force and effect. In the event that we are unable to delete or redact any such Sensitive Personal Data due to restrictions, the Company hereby reaffirm that the sole purpose of the collection and use of your of the copy(ies) of your personal identification data is the verification of your personal identity and that the Company have no intention to collect or use such Sensitive Personal Data. 

                           3. Respect of Personal Privacy

                           The Company respect Data Subject right of Personal Data and we are also aware of the Data Subject intention for the due protection of their Personal Data. As such, any Personal Data submitted to the Company will be used only for the stated purposes. In addition, the Company have strict security measures and protection to prevent unauthorized access to or use of your Personal Data.

                           4. Collection of Personal Data

                           In the direct collection of your Personal Data, inclusive of the use and disclosure thereof, the Company shall obtain your consent should it is required by law and shall use the Personal Data only as necessary and only in accordance with the purposes specified.

                           However, the Company may collect your Personal Data from other sources but only as necessary and carried out in accordance with legal requirements such as from 

GC Group, relevant service providers or public media, for instance.

                           5. Purposes for the Collection, Use and Disclosure of Personal Data

                           The Company collect, use, and disclose your Personal Data for the following purposes:

                           (a) to take steps at your request prior to entering into a contract or for the performance of a contract:

                           - sign-up, enrollment or registration of any kind with the Company;

                           - procurement or sales of products;

                           - providing or receiving services in various forms;

                           - performance of obligations in relation to financial transactions with the Company

                           - administration of contractual relationships and contract management.

                           (b) for legal compliance:

                           - compliance with existing and future laws or regulations applicable to the Company such as public company limited law, securities and exchange law, tax law, labour law and electronic transaction law; and

                           - compliance with lawful orders of relevant government authorities, regulators or competent officers.

                           (c) for the legitimate interests of GC Group:

                           - verification and authentication of your identity;

                           - satisfaction survey and assessment of the products and/or services of GC Group;

                           - research and development as well as improvement of quality of products, operation, services, and related activities and businesses of GC Group;

                           - analyzing and monitoring of services and investigating usage problems;

                           - access control and security control in and outside of the buildings, premises, areas and production units including its information and IT systems of GC Group;

                           - risk management and prevention thereof, including internal and external audit of GC Group;

                           - commencement and exercise of legal claims or legal action and related proceedings;

                           - participation of and arrangement of activities or events of GC Group; 

                           - administration of complaints, suggestions, or requests; 

                           - establishment of a database and the handling of any benefits related to your status as a shareholder or bondholder of GC Group; and

                           - communication and coordination of and within GC Group.

                           (d) for the vital interests:

                           - prevention of life-threatening situations or incidents which may harm the health or cause bodily injury to the data subject or others.

                           (e) for the public interest:

                           - prevention and control of diseases.

                           (f) by consent of the data subjects:

                           - communication of activities, news and public relations;

                           - creating databases for analysis purposes as well as research and development of products and services of GC Group, or of  relevant sales representatives or dealers;

                           - collection, use and disclosure of Sensitive Personal Data the use of is not permitted by any lawful basis, except for your explicit consent;

                           - disclosure of personal data by and among the Company and companies within the PTT Plc. Group or any other external organizations;

                           - transfer of Personal Data to a third country where the Personal Data Protection Committee or any equivalent competent authority(ies) have not approved its data protection standard adequate and in accordance with principles of cross-border transfer of Personal Data; and

                           - in case of a minor, incompetent or quasi-incompetent person requiring consent from, as applicable, his/her parent, guardian, or curator.

                           (g) establishment, exercise, defense of, or compliance with legal claims: 

                           - to establish, exercise, defense or comply with the legal claims.

                           Therefore, the Company will collect, use and disclose your Personal Data subject to your prior consent except where it is authorized to do so by the PDPA, as is necessary for the legitimate interests of the Company or any other persons or juristic persons other than the Company, except where such interests are overridden  by the fundamental rights of your Personal Data, as well as for the Company to comply with law to which the Company are subject.

                           In the event that the Personal Data collected by the Company in relation to the aforesaid purposes are required for the performance of contractual obligations or in accordance with applicable laws. In case of your refusal to provide the Personal Data required, the Company may not be able to proceed with your request to enter into a contract with us, or to perform its obligations under contracts, or it may be considered as an infringement of relevant laws and may cause the Company not to be able to facilitate services for you.

                           Should there be any modification to the purposes for the collection, use or disclosure of Personal Data, the Company will inform you of any such modification and comply with other legal requirements, including the recording as evidence of the amendment of the purposes stated in this Policy. In addition, where you provide the Company with the Personal Data of other person(s) such as you acting as a personal assistance or coordinator of a Data Subject, the Company request that you notify the Data Subject of this Policy, inclusive of seeking for the Data Subject consent. Where necessary, the Company reserve the rights to ask for relevant document or other evidence demonstrating your notification to the Data Subject of this Policy and the relevant consent(s).

                           6. Retention Period of Personal Data

                           The Company will retain your Personal Data only as necessary in connection with the specified purposes, and will collect, use and disclose your Personal Data, as defined in this Policy, in accordance with the duration criteria, namely the period during which you are still related to the Company; provided that, the Company may further retain your Personal Data as long as needed for legal compliance or as per legal prescription, for the establishment of legal claims, legal compliance or exercise of legal claims, or defense of legal claims, or for other purposes in accordance with policies and the internal regulations of the Company. 

                           In the case where it is not possible to specifically specify the retention period, the Company will retain the Personal Data as may be reasonably expected per data retention standards such as the longest legal prescription of 10 years.

                           7. Security Measures

                           The Company have in place adequate and strict security measures, in accordance with Policy and Guidelines on Information Technology of GC Group, to prevent loss, access, destruction, use, alteration, correction, and to prohibit unauthorized or unlawful use of Personal Data. 

                           8. Your Rights as a Data Subject

                           As a Data Subject, you have the rights as prescribed in the PDPA and other rights as follows: 

                           8.1 right to withdraw consent, unless your revocation of consent is restricted bylaw or contract to your benefits as a Data Subject;

                           8.2 right to access to the Personal Data and obtain a copy of your Personal Data under the Company care and responsibility as well as to request the disclosure of the acquisition of your Personal Data without your consent;

                           8.3 right to request for sending or transferring the Personal Data 

(Right to Data Portability);

                           8.4 right to object to the collection, use, or disclosure of Personal Data;

                           8.5 right to request the erasure of Personal Data

(Right to be Forgotten);

                           8.6 right to restrict the use of Personal Data;

                           8.7 right to request for the correction, up-to-date, complete, and will not incur any misunderstanding of the Personal Data;

                           8.8 right to be informed in case of modification of this Policy;

                           8.9 right to complain to authorized officials or authorities as prescribed by the PDPA.

                           In the event that the Data Subject lodges his request to exercise the rights as prescribed by the PDPA, upon reception of such request, the Company will proceed within the duration of time as prescribed thereby. However, the Company reserve the right to deny or not to proceed with the request if allowed by law. In addition, in the case that the Data Subject has chosen to provide the Company with only certain Personal Data, the Company may not to be able to collaborate with or to provide full services to or to perform contractual obligations that we have with the Data Subject, if the Data Subject does not consent to the provision of information as required by the Company. 

                           9. Disclosure of Personal Data to Third Party

                           The Company may need to disclose Personal Data within GC group or to PTT Public Company Limited and its group of companies or to other persons or business units that are strategic allies in Thailand or in a foreign country cooperating with the Company in the procurement and/or delivery of products or services, or as necessary to comply with the Company rules and regulations or any contractual obligation in  providing goods or services and any business operation related thereto; or, in case of reorganization, merger and acquisition or sales of the Company. In addition, the Company may be required to dsiclose Personal Data to external auditors or relevant authorities or public agencies or organizations concerned as prescribed by law or by court order or by the order of authorized officials, provided, however, that, in respect of the Company, the Personal Data will be kept confidential, either in paper form or electronic form, including during its transfer. 

                           In case of an international transfer of Personal Data, the Company will strictly comply with the conditions laid down by the PDPA.

                           10. Data Protection Officer

                           The Company have complied with the PDPA by appointing a Data Protection Officer (DPO) to review the Company collection, use and disclosure of Personal Data to ensure conformation with the PDPA and related laws. 

                           11. Contact

                           ENVICCO Limited

                           Address: No. 888/9, Asia Industrial Estate (GC Estate), Map Chalood -Laem Son Road, Huai Pong Subdistrict, Mueang Rayong District, Rayong 21150

                           Tel: 033-221211 

                           Data Protection Officer (DPO)

                           Address: 

                           Data Protection Officer (DPO)

                           PTT Global Chemical Public Company Limited

                           555/1 Energy Complex, 18th Floor, Building A, 

                           Vibhavadi Rangsit Road, Chatuchak, 

                           Bangkok 10900

                           Email: DPOoffice@pttgcgroup.com  

                           12. Amendment of the Policy and Guideline on Personal Data Protection

                           The Company may, from time to time, review this Policy in compliance with  guidelines and applicable laws. In case of changes, the Company will provide a public notification through appropriate channel.

 Given this day, 30  October 2025

- Natthanun Sirirak -

(Mr. Natthanun Sirirak)

Managing Director

Privacy Notice for CCTV

                           In compliance with the Personal Data Protection Act, B.E. 2562 (2019) (hereinafter "PDPA"), ENVICCO Limited (“Company”) hereby inform you of necessary information in relation to our uses the closed-circuit television (“CCTV”) system for the surveillance, monitoring and recording of motions in and around the Company building and premises as follows

                       1. Collection of Personal Data

                            For the purposes set out in Article 4, the Company collect records from our CCTV system i.e. still and motion (video) without any sound recording.

                       2. Respect of Privacy

                           The Company respect the right to Personal Data and aware of the Data Subjects desire for the due protection of their Personal Data. As such, the Company will use your Personal Data only for the stated purposes. In this regard, the Company have established Personal Data management system comprising of strict information security measures and prevention of unauthorized access or use.

                       3. Collection of Personal Data 

                            Should it is required by law in the collection of Personal Data, the Company will obtain your consent before or upon the collection and the Company will only proceed with such Personal Data as is necessary and only in accordance with specified purposes. 

                       4. Purposes of Collection, Use and Disclosure of Personal Data

                           The Company collect, use, and disclose data via CCTV system for the following purposes:  

                              A.  to control access to the buildings and premises as well as to observe, protect, and to inspect access thereto for security purposes.

                              B.  to ensure safety environment of life and property of our employees, customers, contractors, vendors, visitors and of properties under possession of the Company as well as to inspect, investigate and handle related complaints such tortious claims. 

                              C.  to control access and maintain security of the Company data and IT systems.

                              D.  to monitor, maintain and ensure safety workplace, such as in-plant maintenance activities and production processes of the Company. 

                             The Processing of Personal Data by the Company for the above-mentioned purposes is necessarily required for the legitimate interest of the Company as well as for our performance of contractual obligations in the case that you are our employee or counterparty. 

                             Should there be any modifications to the stated purposes for the collection of Personal Data, the Company will inform you and take necessary action as required by laws as well as to keep records in case of any change or modification to the purposes for the collection, use and disclosure of CCTV data.

                       5. Retention Period 

                            The Company will retain the CCTV data for 90 days. The records will be automatically erased after such retention period. 

                       6. Security Measures 

                            The Company have implemented strict security measures, in accordance with our Policy and Guidelines on Information Technology, to prevent loss, access, destruction, use, alteration, modification, and to prevent unauthorized or unlawful use of Personal Data. 

                            Moreover, the Company have limited access to CCTV data only to authorized CCTV controller and related persons. In addition, password is necessarily required to access any such data and only the chief of Crisis & Security Management Division has authority to determine access thereto.

                       7.  Your Rights as Data Subject 

                             As a Data Subject, you have the rights as prescribed in the PDPA and other rights as follow:

                       7.1 right to withdraw your consent as prescribed by law;  

                       7.2 right to access to the Personal Data; 

                       7.3 right to request for sending or transferring of the Personal Data(right to data portability); 

                       7.4 right to object the collection, use, or disclosure of Personal Data; 

                       7.5 right to request the erasure of Personal Data (right to be forgotten); 

                       7.6 right to restrict the use of Personal Data;

                       7.7 right to request for the correction of the Personal Data; 

                       7.8 right to be informed in case of modification of this Privacy Notice; and 

                       7.9 right to complain to authorized officials as prescribed by PDPA. 

                        In the event that the Data Subject lodges their request to exercise their rights as prescribed by PDPA, upon reception of such request, the Company will further proceed within the duration of time as prescribed by the PDPA. However, the Company may deny or not proceed with such request if and to the extent allowed by laws. 

                       8. Disclosure of Personal Data to Third Party

                           The Company will not disclose CCTV data to any third party unless it is required by law.

                       9. Data Protection Officer

                           The Company have complied with the PDPA by appointing a Data Protection Officer (DPO) to review the collection, use and disclosure of Personal Data of the Company in conformation with PDPA and other related laws.

                       10. Contact

                              Enquiries or questions regarding Personal Data Protection can be addressed to the following channels:

ENVICCO Limited

Contact:

Human Resources and Administration Division
ENVICCO Limited
555/1 Energy Complex, Building A , 15th Floor
Vibhavadi Rangsit Road,Chatuchak,Chatuchak, 
Bangkok 10900
Email: Teerada.R@envicco.com

Data Protection Officer

Contact:
Data Protection Officer (DPO)
PTT Global Chemical Public Company Limited
555/1 Floor 18 Energy Complex Building A 
 Vibhavadi Rangsit Road, Chatuchak, Bangkok 10900

Email: DPOoffice@pttgcgroup.com

                       11. Amendment of the Policy and Guideline on Personal Data Protection

                              The Company may, from time to time, review this Policy in compliance with the guidelines and applicable laws. In case of changes, the Company will provide a public notification through appropriate channels.

 Given this day, 24 May 2022

-Natthanun Sirirak-

(Mr.Natthanun Sirirak)

 Managing Director