BSL Clinic Co., Ltd. (“the Company”) respects and values the privacy rights of job applicants and interview candidates (“you” or “the Applicant”), and is responsible for safeguarding your personal data under the care of BSL Clinic Co., Ltd. The Company is committed to managing such data in a secure, reliable, and trustworthy manner.
Accordingly, the Company has established this Privacy Policy for Job Applicants (“the Notice”) to explain how personal data and sensitive personal data are handled, and to clarify the details regarding the collection, use, disclosure, and purposes for which the Company processes your personal data, as well as to inform you of your rights. The details are as follows:
1. Definitions
“Applicant” means a job applicant, regardless of the method used to apply for a job, such as walk-in application, postal mail, email, the Company’s website, third-party platforms, or social media channels, whether the application is made directly by the Applicant, through internal recruitment within the Company, by referral from an individual or organization, and/or through a recruitment service provider.
“Personal Data” means any information relating to a natural person which enables the identification of such person, whether directly or indirectly, but excludes the data of deceased persons specifically.
“Sensitive Personal Data” means personal data relating to race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disability, trade union information, genetic data, biometric data, or any other data which may similarly affect the data subject, as prescribed by the Personal Data Protection Committee.
2. Categories of Personal Data
BSL Clinic Co., Ltd. collects your data, which may include the following categories, depending on the circumstances and the nature of activities for which the Company needs to process your data:
2.1 Personal Information: such as name, surname, date of birth, photograph, nationality, marital status, and military status.
2.2 Contact Information: such as residential address, telephone number, email address, and social media account information.
2.3 Education and Training Information: such as educational background (e.g., name of institution, faculty, field of study, and graduation year), academic results, test results, records of training or internships, certifications specified in the application, and other qualifications, including professional qualifications, language proficiency, and other skills.
2.4 Employment History: such as employment records, work experience including position, salary, performance evaluations, social security, workmen’s compensation fund, and provident fund.
2.5 Job Application Information: such as personal history, work history, cover letter, information provided in documents submitted to the Company (e.g., resume, curriculum vitae (CV), expected salary), interview information, self-introduction videos, information provided to the Company during interviews, references or recommendation letters, and information contained in interview evaluation forms. This also includes other information necessary for recruitment and selection, such as assessment results, knowledge and experience, personal characteristics, ability to work with others, and supporting certificates for consideration.
2.6 Supporting Documentation for Job Application or Legal Transactions: such as copies of identification cards, copies of name-change certificates, copies of house registration, copies of military service certificates, copies of bank account passbooks, social security registration forms, consent forms for background checks, employment guarantee letters, guarantor certificates, or documents identifying an employment guarantor.
Personal Data of Third Parties Provided by You or Obtained by the Company from Third Parties: This includes personal data of other individuals for whom you represent and warrant to the Company that you have obtained their consent to disclose such data to the Company, as well as their consent for the Company to process their personal data for the purposes specified in this Notice. Such data may include the name, surname, occupation, workplace, and telephone number of your spouse, children, father, mother, or family members whom the Company may contact in case of emergency, or individuals you provide as references for verification and employment certification, and/or employment guarantors. It also includes information provided by third parties regarding behavioral details about the Applicant.
3. Categories of Sensitive Personal Data
BSL Clinic Co., Ltd. does not intend to collect, use, or disclose your sensitive personal data.
However, if such data appears on your identification card, house registration, or other documents that you voluntarily disclose to the Company (such as data relating to race or religion), and you submit any information containing such sensitive data to the Company, whether in document form or by other means, the Company recommends that you redact such sensitive personal data yourself by striking it out.
If you do not redact such data, the Company shall deem that you have expressly authorized the Company to redact such information on your behalf, and that the documents you submit—once the Company has redacted the sensitive personal data—shall be considered complete and legally enforceable. The Company may then process such documents under the Personal Data Protection Act B.E. 2562 (2019).
In the event that the Company is unable to redact sensitive personal data on your behalf due to technical or other issues, the Company will retain such sensitive personal data solely as part of your identity verification documents.
4. Sources of Personal Data
BSL Clinic Co., Ltd. collects and receives your personal data through the following channels:
4.1 Personal data provided directly by you
The Company collects and receives your personal data directly from you, which may be in the form of documents or electronic data. You may provide such data by filling in documents prepared by the Company, submitting information through the online platforms designated by the Company, walk-in job applications, or applications submitted via the Company’s website. This also includes cases where you attend job interviews, enter into contracts with the Company, or submit documents containing your personal data to the Company.
4.2 Personal data received from third parties
The Company may receive your personal data from third parties and/or other persons acting as data controllers or data processors, and the Company reasonably believes that such parties are authorized to process and disclose your personal data to the Company. Such sources may include, but are not limited to, the following:
4.2.1 Social media platforms, social media data sources, or other public sources, third-party online platforms, and job application websites such as JobsDB, JobsThai, Jobbkk, etc.
4.2.2 Recruitment agencies, government agencies, educational institutions, and any individuals acting on behalf of such entities.
4.2.3 Information obtained from telephone communications and data related to the recruitment process.
5. Purposes and Legal Bases for Processing Personal Data
5.1 The Company processes the Applicant’s personal data for purposes relating to the consideration of employment. For this reason, the Company requires accurate and complete personal data from you. If you do not wish to provide such personal data, the Company may be unable to select you or enter into an employment contract with you. In such cases, the Company may have to decline entering into an employment contract with you. However, where the Company requests your consent, you have the option to grant or withhold such consent. Withholding consent will not affect the assessment of your qualifications, but it may prevent the Company from contacting you regarding potential suitable job opportunities in the future.
5.2 In the event that the Company processes your personal data in a manner and/or for purposes not aligned with the purposes specified herein, the Company will issue an additional Personal Data Protection Notice and/or provide you with an explanation of such processing. You should review such additional notice(s) in conjunction with this Notice and/or other relevant documents, as the case may be.
5.3 The Company may rely upon or refer to the following legal bases when processing your personal data:
5.3.1 Consent, for processing your personal data.
5.3.2 Contractual obligations, for initiating, entering into, or performing a contract with you.
5.3.3 Legal obligations, for compliance with the Company’s statutory duties.
5.3.4 Legitimate interests of the Company or third parties.
5.3.5 Public interest, for carrying out tasks in the public interest or in the exercise of official authority, or any other lawful basis as provided under the Personal Data Protection Law. In this Notice, the Company will specify the purposes of processing based on the specific activities undertaken, as outlined in the processing activity table.
No.
Purpose
Legal Basis for Processing
1
Recruitment, job interviews, applicant selection, background screening, verification of applicant qualifications according to the Company’s criteria, identity verification, and communications related to the job application process
Performance of contract / Legitimate interests
2
Searching for job applicants who disclose information through social media, other public sources, job application websites, or third-party online platforms, and contacting you regarding the position you applied for or may be interested in applying for
Legitimate interests
3
Verification of educational background or employment history from other sources, data analysis, recording of self-introduction videos, evaluation and scoring of applicants for employment decision-making
Legitimate interests
4
Pre-employment medical examination, execution of employment contract
Performance of contract / Legitimate interests
5
Contacting job applicants to provide news or offer other suitable job positions
Consent
6
Disclosure of information in the job application to affiliated companies for consideration of applicant qualifications prior to an interview
Consent
7
Verification of personal history and criminal record with the Criminal Records Division of the Royal Thai Police or relevant authorities (for certain positions specified by the Company only)
Consent
8
Verification of bankruptcy records, credit information, financial history, and assessment of individual risks related to money laundering (for certain positions specified by the Company only)
Legitimate interests
9
Disclosure of internship history, internship results, and internship duration to educational institutions or other organizations
Performance of contract / Legitimate interests
10
To prevent and mitigate dangers to your life, body, or health, or that of others, such as emergency contact, communicable disease control, temperature recording, and your travel history
Legitimate interests / Compliance with the law
11
To comply with applicable laws, regulations, and rules, both domestic and international, and to comply with orders of legally authorized officers, such as compliance with subpoenas, court orders, orders of government agencies, regulatory authorities supervising the Company, or competent officials
Compliance with the law
6. Disclosure of Personal Data
The Company may disclose your personal data, under the purposes specified and in accordance with the law, to the following persons and entities:
6.1 Executives and employees, only as relevant and necessary.
6.2 Service providers and personal data processors engaged or appointed by the Company to manage or process personal data on behalf of the Company in providing various services. This also includes those acting in the name of, or in cooperation with, the Company to carry out related purposes as specified in this Notice, where it is necessary to access your personal data. Such services may include information technology services, data recording services, human resource management services, or other services that may benefit you or relate to the Company’s business operations, where disclosure of your personal data is reasonably necessary to achieve the Company’s business objectives.
6.3 Any other persons or entities to whom you have consented for the disclosure of your personal data.
6.4 The Company will require the recipients of personal data to implement appropriate measures to protect your data and to process such personal data only as necessary. The Company will take action to prevent any unauthorized use or disclosure of personal data and will process it only for the purposes specified in this Notice or for other purposes permitted by law. In cases where the law requires your consent, the Company will request your consent in advance.
7. Transfer or Transmission of Personal Data to Other Branches of the Company
The Company may store your data on computer servers or cloud services provided by third parties and may use third-party programs or applications in the form of software-as-a-service (SaaS) or platform-as-a-service (PaaS) for processing your personal data. However, the Company will not permit any unrelated parties to access your personal data and will require such third parties to implement appropriate security and data protection measures.
In the event that the Company transfers or transmits your personal data to other branches of the Company, the Company will ensure that such branches have adequate standards of personal data protection, or will ensure that such transfer or transmission of your personal data is carried out in compliance with the requirements of the Personal Data Protection Law.
8. Retention Period of Personal Data
8.1 The Company will retain personal data only as long as necessary for the purposes of processing as specified in this Notice, as follows:
8.1.1 The Company will retain personal data of job applicants for a period of five (5) years from the year in which you applied for employment with the Company.
8.1.2 In cases where the Company processes your personal data based on your consent, the Company will retain such data for a period of five (5) years from the year in which you provided consent.
8.1.3 In cases where you exercise your rights as specified in this Notice, the Company will retain records of the exercise of rights under the Personal Data Protection Law for a period of five (5) years from the month in which the Company has completed consideration of your request.
8.2 In other cases, the Company may retain your personal data for as long as reasonably necessary for the Company to fulfill its obligations and achieve the purposes specified in this Notice. Where a definite retention period cannot be determined, the Company will retain the data for a period that can reasonably be expected in accordance with standard data retention practices (e.g., the maximum statutory limitation period of ten (10) years). In the event of legal proceedings, your personal data may be retained until the completion of such proceedings, including any additional period necessary to achieve the intended purposes. Thereafter, your data will be deleted or retained only as permitted by law.
8.3 Upon expiration of the specified retention periods, the Company will delete, destroy, anonymize, or otherwise process the personal data in accordance with the Personal Data Protection Law to ensure effective protection of personal data. However, the Company may retain certain data longer than the periods specified above if required to comply with applicable laws, orders of competent authorities or government agencies, or for business or other legitimate purposes.
9. Rights of Data Subjects
The Company respects your privacy rights and provides you with the opportunity to choose how to control or how the Company contacts you. The Company will comply with your requests in order to promote transparency, as well as to ensure the quality and accuracy of your personal data.
You are entitled to the rights under the Personal Data Protection Law, and you may submit a written request to the Company through the channels designated by the Company to exercise the following rights:
9.1 Right to Withdraw Consent: If you have given consent for the processing of your personal data (whether such consent was provided before or after the enforcement of the Personal Data Protection Law), you have the right to withdraw such consent at any time while your personal data is held by the Company. Please note that the withdrawal of consent does not affect the lawfulness of processing based on consent previously given, except where your right to withdraw is restricted by law, by circumstance making withdrawal impossible, or where there is a contract between you and the Company that provides you with benefits. Withdrawal of consent may also result in the Company being unable to achieve certain purposes, in whole or in part, as specified in this Notice.
9.2 Right of Access: You have the right to access your personal data under the Company’s responsibility and to request a copy thereof, as well as to request that the Company disclose how it obtained your personal data. The Company may refuse your request if permitted by law, by court order, or if fulfilling your request would adversely affect the rights and freedoms of others.
9.3 Right to Data Portability: You have the right to request the transfer of your personal data where the Company has arranged such data in a format that is readable or usable by automated tools or devices, and can be used or disclosed by automated means. You also have the right to request that the Company transmit or transfer such data to another data controller, where technically feasible, or to receive the data directly yourself. Such rights apply only to personal data you have consented to provide to the Company, or personal data that the Company needs to process in order to provide services to you under a contract, or in order to take steps at your request before entering into such services, or other personal data as prescribed by law.
9.4 Right to Object: You have the right to object to the processing of your personal data at any time if such processing is carried out for the Company’s legitimate interests, or for the interests of another person or legal entity, within reasonable expectations, for the performance of tasks carried out in the public interest, or for scientific, historical, or statistical research purposes. If you object, the Company will continue to process your personal data only where it can demonstrate compelling legal grounds that override your fundamental rights, or where the processing is necessary for legal claims, compliance with law, or defense in legal proceedings, as applicable.
9.5 Right to Erasure: You have the right to request the deletion or destruction of your personal data, or to anonymize it so that you can no longer be identified, if you believe your personal data has been unlawfully processed, if the Company no longer needs to retain it for the purposes set out in this Notice, or when the Company determines that it can comply with your request to withdraw consent or object as stated above.
9.6 Right to Restrict Processing: You have the right to request the temporary suspension of the use of your personal data where the Company is verifying a request for rectification or objection, or in other cases where the Company is required by law to delete or destroy your personal data but you instead request restriction of its use.
9.7 Right to Rectification: You have the right to request the correction of your personal data to ensure it is accurate, up-to-date, complete, and not misleading. If you wish to request the correction of image-related data, the Company will correct only such image data as is necessary and lawful. In cases where processing your request incurs costs, the Company may charge you such fees.
9.8Right to Complain: You have the right to file a complaint with the Company via the Data Processing Complaint Form or with the relevant legal authorities if you believe that the processing of your personal data violates or does not comply with relevant laws.
10. Exercising Data Subject Rights
10.1 Any request to exercise your rights must be made in writing via the electronic system provided by the Company on its website, or by filling out the Personal Data Subject Rights Request Form, or in case you wish to withdraw your consent, you can fill out the Consent Withdrawal Request Form.
The Company will use its best efforts to proceed within a reasonable period, not exceeding 30 days from the date of receipt of the request. However, the Company has the right to reject your request if there are legal exceptions, or if the Company cannot perform its contractual duties, or if it impacts the performance of contractual duties, or if it is a refusal based on a court order, or if the Company’s action on your request would cause potential harm to the rights and freedoms of others. The Company will record the rejection of the request along with the reasons. If it is clearly apparent that your request is unreasonable or excessive, the Company reserves the right to charge a fee for processing your request at a rate determined by the Company.
10.2 The Company will make its best efforts based on the capabilities of its relevant systems to facilitate and act on your request, unless it becomes evident that doing so would risk violating the rights and freedoms of other users, or would contravene the law or the system’s security policies, or if it is practically impossible to fulfill the request due to technical reasons.
10.3 The Company will make its best efforts based on the capabilities of its relevant systems to facilitate and act on your request, unless it becomes evident that doing so would risk violating the rights and freedoms of other users, or would contravene the law or the system’s security policies, or if it is practically impossible to fulfill the request due to technical reasons.
10.4 In some situations, the Company may ask you to prove your identity before exercising your rights for your own safety. There might be some limitations on exercising certain rights, which the Company will explain to you if it cannot fulfill your request.
10.5 In cases where the Company processes your personal data based on the legal grounds of contractual performance, legitimate interest, or legal duty, the Company has the right to refuse your request to object, suspend the use or disclosure of your personal data, or to have your personal data erased or destroyed. This includes situations where the Company may refuse to act on your request if it is necessary to retain the data.
10.6 The Company must inform you that exercising certain rights may have limitations if the personal data is absolutely necessary for the Company to comply with legal duties and maintain the security of the Company, its surroundings, its property, the security of the activity area, and your own safety.
11. Security Measures
The Company has established appropriate security measures for personal data to prevent loss, unauthorized or unlawful access, use, alteration, modification, or disclosure. These measures are in line with the Company’s information security policies and practices and its Privacy Policy.
12. Information about Third Parties
If you provide personal data of any third parties, such as a spouse, child, parent, family member, beneficiary, emergency contact person, reference, and other related individuals, you certify that you have the authority to provide their personal data and have the duty to ensure that these individuals permit the Company to use their personal data in accordance with this notice. You are also responsible for informing these individuals and obtaining their consent.
13. Contact Channels
In the event that a data subject has any questions, wishes to exercise their rights as specified in this notice, or seeks further inquiries regarding personal data for job applications, they may contact the Human Resource Data Protection Officer.
The Company reserves the right to amend, review, and revise this Privacy Notice, which will be effective upon publication without prior notice. This is for the purpose of ensuring the suitability and efficiency of our services. Therefore, the Company recommends that you read the Privacy Notice every time you visit or use services from the Company or its website.
