Privacy Policy of Fortune Parts Industry Public Company Limited

Fortune Parts Industry Public Company Limited ("the Company") respects the right to privacy and emphasizes the protection of personal data that related to transaction with the company. Therefore, it is important to have a data protection policy, and to have rules, mechanisms, regulatory measures and the management of personal information as follows:

1. Scope of application

This Privacy Policy is applicable to the performance of all employees, which means full-time employees, employees of employment contract specifying the expiration date of the contract, temporary worker and contractor including those who process personal data on behalf of the company.

2. Definition

1. "Personal Data" means information about an individual by which an individual can be identified whether directly or indirectly but does not include information of the deceased in particular.
2. "Sensitive Personal Data" means information that is truly personal to an individual, which are sensitive and may run the risk of unfair discrimination such as race, ethnicity, political opinion, religious beliefs or philosophy sexual behavior, criminal records, health information, disability, trade union information, genetic information, biological information or any other information which affects the owner of personal data in the same way as announced by the Personal Data Protection Committee.
3. "Processing" means the process of collecting, use, disclosure, deletion or destruction of personal data.
4. "Personal Data Subject" means an individual who is the owner of the Personal Data from which the Personal Data is personally identified in both directly or indirectly way.
5. "Personal Data Controller" means a person or juristic person who has the authority to make decisions about the collection, use or disclosure of personal data.
6. "Personal Data Processor" means a person or a legal entity who performs the collection, use or disclosure of personal data on the order or on behalf of the company, but this person is not a controller of personal data.
7. "Company" means Fortune Parts Industry Public Company Limited and its subsidiaries according to the consolidated financial statements of Fortune Parts Industry Public Company Limited.

3. Collection of personal information

1. The Company will collect personal data for the purpose, scope and use with rightful and fair methods. The collection will be done only to the extent necessary for the operation of the company's objectives.
2. The company will proceed to inform the owner of the information and give consent by electronic or according to the company's method. In case of sensitive personal data of the data subject is stored, the company will expressly obtain consent from the data subject prior to collection. Unless the collection of personal data and sensitive personal data is subject to exceptions as specified in the Personal Data Protection Act B.E. 2562 or other laws.

4. Purposes for collecting or using personal data

1. The company will collect or use the personal information of the data subject for the benefit of the company's operations to improve the quality of operations to be more efficient and, or to comply with any laws or regulations relevant to the company's operations. The company will store and use such information only for the necessary time and the purposes for which the data subject has been notified or as required by law.
2. The company will not take any action that different from those stated in the purpose of collection, unless
   1. notifying the new purpose to the data subject and obtaining the consent of the data subject
   2. It is in compliance with the Personal Data Protection Act or other relevant laws.

5. Disclosure of personal information

1. The company will not disclose the personal information of the data subject to any person without consent and will disclose it for the stated purpose.
2. The company may have a necessity in disclosing personal data of the data subject to its affiliates or other parties in both domestic and international for the benefit of the company's operations and providing services to the data subject. Fot disclosing personal information to such persons, the company will ensure that those individuals keep their personal information confidential and do not use it for any purpose other than the scope specified by the company.
3. The Company may disclose personal information of the information subject under the rules prescribed by law, such as disclosing personal information to government agencies, government agency regulators including in the event of a request to disclose information by virtue of law.

6. Security of personal information

1. The company will provide measures to maintain the security of personal data that are appropriate and consistent with the law, policies, regulations, requirements and practices on personal data protection for the company's employees and other related parties.
2. The company supports and encourages employees to be knowledgeable and aware of their duties and responsibilities in collecting, keeping, using and disclosuring the data subject's personal data in order for the company to properly comply with personal data protection policies and laws effectively.

7. Rights of the personal data subject

1. The right to request access and obtain a copy of personal data relating to oneself or requesting to disclose the acquisition of such personal data that he/she did not give consent
2. The right to object to the collection, use or disclosure of personal information about oneself
3. The right to request removal, destruction, or make personal information non-identifiable information to the person who owns the personal information
4. The right to request to suspend the use of personal data
5. The right to withdraw consent to the processing of personal data for which consent has been given. However, revocation of consent does not affect the collection, use or disclosure of personal data for which consent has been given.
6. The right to correct personal data
7. The right to transfer personal data

8. Supervision of personal data protection compliance

1. The company will provide a follow-up process in the event that the law changes, and constantly update personal data protection measures to be in line with the law.
2. The company will regularly review and update policies, standards, guidelines, procedures and other documents related to the protection of personal data in order to be up-to-date in accordance with the laws and circumstances of each period.

9. Roles, duties and responsibilities

1. The Board of Directors has roles, duties and responsibilities as follows:
   1. Regulate the creation of a personal data governance structure and related internal controls in order to comply with the law and privacy protection policy
   2. Supervise and support the company to carry out the protection of personal data to be effective and in accordance with the law.
2. Privacy Committee

Let the Company’s Risk Management Committee act as the Personal Data Protection Committee with the following roles, duties and responsibilities:

1. Establish a personal data governance structure and relevant internal controls, including the Privacy Incident Management Policy and the Incident Response Program, to be able to identify and deal with unusual incidents related to personal data promptly.
2. Evaluate the effectiveness of the company’s personal data protection policy, and report the results of such assessments to the Board of Directors on a regular basis at least once a year, and supervise to ensure that risks related to personal data are handled and appropriate risk management guidelines are in place.
3. Determine and review operational standards and guidelines to ensure that the company’s operations are in accordance with the law and privacy protection policy.
4. Appoint the Company’s Personal Data Protection Officer (FPI DPO)
5. Executives have roles, duties and responsibilities in monitoring and controlling agencies that are in compliance with the personal data protection policy and promote awareness raising among employees.
6. The Company’s Personal Data Protection Officer (FPI DPO) has roles, duties and responsibilities as required by law. This includes the following duties:
   1. Regularly report the status of personal data protection to the Personal Data Protection Committee, and always make recommendations to improve the protection of personal data to be up-to-date and consistent with the law.
   2. To advise employees on the collection, use or disclosure of personal information relating to compliance with the law and the company’s personal data protection policy.
   3. Examine the operations of the agency to comply with the law and privacy policy.
   4. Coordinate the handling of complaints or requests to exercise the rights of the personal data subjects who have been contacted or requested from the personal data subjects.
   5. Coordinate and cooperate with the Office of the Personal Data Protection Commission in the event of a problem relating to the collection, use or disclosure of personal information of the company, subsidiaries and business partners.
   6. Notify the Office of the Personal Data Protection Commission of the incident of personal data breach within 72 hours from the knowledge of the incident.
7. Employees have the following roles, duties and responsibilities.
   1. Comply with the personal data protection policy, standards, guidelines, procedures and other documents related to the protection of personal data.
   2. Report unusual incidents related to personal data protection and non-compliance with the law and the company’s personal data protection policy and inform the supervisor.

10. Review and change of personal data protection policy

The company may improve or update this policy from time to time to comply with legal requirements and changes in the company’s operations including suggestions and opinions from various agencies. The company will clearly announce the changes.

11. Penalty for non-compliance with the Privacy Policy

Failure to comply with the personal data protection policy of Fortune Parts Industry Public Company Limited may result in an offense and subject to disciplinary action, including penalties as required by law.

Data Controller Contacting the Company

Fortune Parts Industry Public Company Limited
11/22 Moo 20, Nimitmai Road, Lam Luk Ka Subdistrict, Lam Luk Ka District, Pathum Thani Province 12150
Website : www.fpiautoparts.com
E-mail : info@fpiautoparts.com
Phone : 02-993-4970-7
 

Data Protection Officer (DPO)

Contact method: 11/22 Moo 20, Nimitmai Road, Lam Luk Ka Subdistrict, Lam Luk Ka District, Pathum Thani
Contact method: e-mail pdpa@fpiautoparts.com
Phone : 02-993-4970-7 ext. 108,297

This Privacy Policy is effective from May 1, 2022 according to the Board of Directors of Fortune Parts Industry Public Company Limited dated May 13, 2022.

sign
(Mr. Sompol Thanadumrongsak)
Managing Director