HR Privacy Notice

Last update: March 2022

Pomelo Fashion Co., Ltd. (“we”, “our”, “us”) knows that our employees, job applicants, candidates, and interns (“you”, “your” or “yourself”) care about how your personal data is processed, and we take your privacy seriously. This HR Privacy Notice, including any updates thereof describes how we collect, store, use, disclose, transfer, and otherwise process your personal data, including your data protection rights throughout our recruitment and employment process.

This privacy notice applies to all prospective, job applicants and candidates, current and former employees and interns, and covers our treatment of personal data that we collect, store, use and disclose before, during and after your relevant relationship with us.

We may update this privacy notice from time to time and such update will become effective upon uploaded. We recommend you regularly check and review this page to see when this privacy notice is latest updated. In case of any significant update, we will provide additional notice to you.

1. What type of Personal Data do we collect from you?

We may collect various types of your personal data including:

Basic Data

identification details, such as title, name, last name, nickname, signature, photograph, copy of identification card, passport, driving license, social security number, work permit, house registration and any similar identifiers;
personal details, such as age, date and place of birth, gender, blood type, height, weight, marital status, citizenship, nationality, military service, personal loans, and other similar personal details;
contact details, such as address, telephone numbers, email addresses, emergency contact information and other similar contact details;
education background, transcripts, certificates, licenses, information of general interests, any information you have provided to us in your CV or during interviews, including information gathered from reference persons whose contact details you have provided to us; and
details of your vehicle, such as car registration manual;

Employment Data

details of qualifications, skills, work experience, employment records, current salary and other incomes, desired salary, and reasons for leaving your previous employment;
work contact details, commencement date of work, position, department, working hours, vacation and absence;
work preferences, such as working hours or store locations;
record of salary, compensation, welfare, benefits, bonuses, and expenses during your employment with us;
financial information such as bank account details and payroll records, including credit information;
performance evaluation details such as assessment, performance reviews and other records;
other information you may provide to us through surveys and questionnaires;
CCTV footage and other information obtained through electronic means;
details of any disciplinary procedures in which you have been involved such as any warnings issued and related correspondences, litigation records and court decisions; and
leaving date and reasons for leaving your employment with us;

Sensitive Data

We may collect sensitive personal data which we use only as strictly necessary for the purpose it is collected with your knowledge and consent if required by applicable laws, including:

information about your health, including any medical condition, health, and sickness records;
information about criminal convictions and offences;
biometric data, such as fingerprint and facial biometric;
race; and
sensitive data in the official identification document, such as religion.

2. Why do we collect and process your Personal Data?

In processing your personal data, in addition to the consents we have obtained from you, we rely on more than one legal basis depending on the specific purpose and circumstances for which we are using your personal data as described in the table below:

Purposes	Legal basis
To process your application and conduct recruitment process, including criminal record check and assessing working capacity based on health conditions, as well as to arrange interview and make employment decision	Contractual obligation Legitimate interests Explicit consent in respect of information relating to criminal records and health information
To enter or perform employment contract	Contractual obligation
To conduct and record employees performance evaluation and assessment	Legitimate interests Contractual obligation
To keep security of the work premises via surveillance cameras (CCTV) and other means, as well as administer time attendance recording	Legitimate interests Explicit consent in respect of your biometric data (i.e. fingerprint and facial biometric)
To facilitate employees compensation with applicable deduction of tax, mandatory contributions in accordance with applicable laws	Contractual obligation Legal obligation
To provide the agreed or complementary benefits according to company’s policy	Contractual obligation
To provide employees training and development activities	Legitimate interests Explicit consent in respect of your race and religion
To gather and manage information for investigations or disciplinary matters	Contractual obligation Legitimate interests
To comply with legal obligations, legal proceedings, or government authorities’ orders	Legal obligation
To maintain employment related record as necessary for managing performance records or if required by applicable laws	Contractual obligation Legal obligation Legitimate interests
To process the termination of employment, including preparing relevant documents and making necessary arrangements for the termination, as well as reporting to relevant authorities if required by applicable laws	Legal obligation Contractual obligation
To establish, exercise or defend legal claims	Legitimate interests
To prevent fraud and crime	Legal obligation Public interest Legitimate interests

In some circumstances, we may also rely on other legal basis, i.e. legal obligation, legitimate interest, vital interest and/or public interest to use your personal data.

3. Where do we collect your Personal Data?

We, directly or indirectly, collect your personal data from the following sources:

information you provide to us through the use of our website, applications or through contact with us via email, telephone, social media, or other means; and
our group companies, employment agencies, recruitment websites, former employees, reference persons and government authorities.

In the event that you provide personal data about someone else such as spouse, dependents, parents, references, and other persons, you are responsible for ensuring that you are authorized to share such information with us and that we can collect, store, use, disclose, transfer or otherwise process such personal data without taking any further steps for the purposes stated herein.

We do not knowingly collect personal information from anyone under the age of 20, quasi-incompetent persons, or incompetent persons for any purpose or knowingly allow such persons to register for any of our services without their parent or guardian having given the consent when it is required. If you are under the age of 20, you must obtain your parent or legal representative’s consent prior to your disclosure of personal data to us.

4. To whom do we disclose and/or transfer your Personal Data?

Where necessary, we may disclose or transfer your personal data with third parties, which may be located in Thailand or overseas, in the following situations:

Our group companies for the purposes of processing application, recruitment process, maintaining and updating employee directory and related activities, which primarily include the following group companies and affiliates and include any entities that may become our group companies or affiliates in the future (collectively “Pomelo Group Companies”):
- Pomelo Fashion Pte. Ltd.;
- Paciva Enterprises Co., Ltd.;
- Pomelo Fashion Malaysia Sdn. Bhd.;
- Pomelo Fashion (Dongguan) Company Limited; and
- PT Pomelo Busana Indonesia;
Third-parties providers that provide services to support our business operation, including external employment agents, advisors, professionals, consultants in relation to employment, work permit, visa, payroll, human resources, security, benefit providers, IT service providers and etc.;
Regulators and governmental agencies where your personal data is legally required to be disclosed to regulators, law enforcement agencies, courts, or other government authorities (e.g. the Social Security Office, the Revenue Department, the Department of Skill Development, the Legal Execution Department and etc.); and
Prospective buyers – in case where we sell all or part of our businesses, undergo a merger, enter into a partnership, or if we go out of business or enter bankruptcy.

We require any person or entity to whom we disclose your information to respect the confidentiality and security of your personal data and to treat it in accordance with applicable laws and regulations. We do not allow such recipients of your personal data to use it for their own purposes, and we only permit them to process your personal data for specified purposes and in accordance with our instructions.

5. Cross-Border Transfer of Your Personal Data

implementing adequate personal data protection standards for the transfer of your Personal Data outside Thailand. We shall also ensure that any third parties to whom your Personal Data will be disclosed or transferred shall implement adequate personal data protection standards, and where your Personal Data will be transferred to Pomelo Group Companies, we shall use data transfer mechanisms, i.e. binding corporate rules.

6. For how long do we retain your Personal Data?

We will retain your personal data as long as it is necessary for the purpose of processing, as well as complying with our legal obligations. Particularly, if your application for employment is unsuccessful, we will retain your personal data for a period of three (3) years after the end of the relevant recruitment process for our future consideration.

Notwithstanding the above, your personal data will generally be kept for a period of ten (10) years after the termination of your employment relation with us, or otherwise for a longer period if it is required by applicable laws or as necessary for legal claims. Subsequently, certain information may continue to be stored in an aggregated and anonymised format.

7. What are your rights in relation to your Personal Data?

Under certain circumstances and subject to certain exemptions under applicable data protection laws, you are entitled to the following rights:

Right to access – to request access to and obtain a copy of your personal data, or to request the disclosure of the acquisition of your personal data;
Right to data portability – where we have carried out the processing by automated means, to receive a copy of your personal data in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means;
Right to object – to object any processing of your personal data by us based on our legitimate interests, unless (i) we can demonstrate an overriding legitimate ground; or (ii) the processing is for the establishment, exercise or defence of legal claims. In any case, you may at any time object to our processing of data for direct marketing purposes;
Right to be forgotten – to request us to delete or anonymise your personal data where (i) the personal data is no longer necessary for the processing purposes; (ii) you withdraw the consent given to us and we do not have other legal ground for processing; (iii) you object the processing of your personal data by us based on our legitimate interests and we do not have an overriding legitimate ground for the processing; and (iv) your personal data is unlawfully processed;
Right to restrict processing – you have the right to restrict our processing of your personal data where (i) you believe such data to be inaccurate; (ii) our processing is unlawful but you want us to retain such data; and (iii) the personal data is no longer necessary for the processing purposes but you want us to retain such personal data for the establishment, exercise or defence of legal claims and (iv) you have objected to the processing your personal data based on our legitimate interest and we are considering the request;
Right to rectification – to request us to correct or update any inaccuracy of your personal data;
Right to withdraw consent – where you have provided us with your consent to process your personal data, to withdraw your consent at any time; and
Right to lodge a complaint – to lodge a complaint to relevant authority in case that we process your personal data unlawfully or not in compliance with applicable laws.

The exercise of your rights is subject to the limitations prescribed by law. Where applicable and unless otherwise specified herein, you are entitled to exercise your rights set out above by contacting us using the contact details below. We will process your request according to our obligations under the law. Please note that in certain circumstances, where permitted by law, we may not be able to fulfil your request. You will be notified accordingly.

8. Our contact details

In case you have any question with regard to this privacy notice, please contact us at our contact details below:

Pomelo Fashion Co., Ltd.
Email: hr@pomelofashion.com