Toyota Daihatsu Engineering & Manufacturing Co., Ltd. (“TDEM”, “we”, “us” and “our”) recognizes the importance of the protection of your Personal Data (as defined below). This Privacy Policy (“Policy”) sets out how we collect, use, disclose and/or transfer outside Thailand of your Personal Data obtained from you or other sources, as well as your rights and our practices of such Personal Data.

1. ABOUT US

   TDEM is the data controller for collection, use, disclosure and/or transferring outside Thailand of your Personal Data. TDEM is a juristic person established under the laws of Thailand with its principal office address at 99 Moo 5, Ban-Ragad, Bang-Bo, Samutprakarn 10560.

   TDEM is a part of the Toyota worldwide family and operates as a regional headquarter for provision of various businesses, including, research and development, production engineering and procurement in Asia-Pacific region. TDEM develops regional resources to meet global standards, based on advanced technology and know-how provided by Toyota Motor Corporation (TMC) and Daihatsu Motor Co., Ltd. (DMC), and works toward development of regional automotive industry through Toyota’s Ever-better Cars.

2. HOW TO CONTACT US

   If you have any questions about this Policy or want to exercise your rights set out in this Policy. You can contact us using the following contact details:

   • Send us an email to: privacypolicy@tdem.toyota-asia.com
   • Call us on: (66) 02-790-5000
   • Write to us at: 99 Moo 5, Ban-Ragad, Bang-Bo, Samutprakarn 10560
3. WHAT IS PERSONAL DATA?

   Personal Data is any information relating to an individual, which enables the identification of such individual, whether directly or indirectly, but not including the information of the deceased persons in particular.

4. WHAT PERSONAL DATA IS COLLECTED?
   1. The specific type of Personal Data collected will depend on the context of your interaction with us or relationship between you and us. We may collect, use, disclose and/or transfer outside Thailand various types of Personal Data about you including, but not limited to:
      1. (a) Personal details: such as title, name, family name, gender, age, occupation, qualifications, job title, position, business type, nationality, country of residence, date of birth, marital status, number and details of family members and children (e.g. name, gender, age), information on government-issued cards (e.g. national identification number, social security number, passport number, tax identification number, driver’s license details or similar identifiers), immigration details (e.g. arrival and departure date), signature, voice, voice record, photograph, facial features for recognition, CCTV records, workplace, education, insurance details, license plate details, house registration, household income, salary and personal income, job application details (e.g. resumes and/or applications, references and interview notes), and any other personal details you provided to us;
      2. (b) Contact details: such as postal address, delivery details, billing address, telephone number, fax number, email address, LINE ID, and other ID from social networking sites, your contact person’s contact details, and any other contact details you provided to us;
      3. (c) Financial details: such as bank account details, and any other financial details;
      4. (d) Transaction details: such as details about payment to and from you, payment date and/or time, payment amount, and any other details of services or products you have provided to or received from us;
      5. (e) Marketing and communication details: such as your preference in receiving contact from us, companies in Toyota affiliate companies, subsidiaries, business partners or other companies, and any other marketing and communication details;
      6. (f) Technical details: such as Internet Protocol (IP) address, cookies, login data, device ID, search history, browsing details and patterns, browser type, and version, time zone setting and location, and any other technical details from the use on the platforms and systems; and/or
      7. (g) Sensitive data: such as race, religion, political opinions, genetic data, fingerprints, facial recognition, physical or mental health or condition, blood type, medical history, disability, criminal records, and any other similar data.
   2. If you provide Personal Data of any third party (e.g. name, family name, address, telephone number, of your beneficiary, emergency contact person, and references) to us, you must ensure that you have the right to do so and we have obtained the right the use their Personal Data accordance with this Policy. Please provide this Policy for their acknowledgment and/or obtaining consent (or rely on legal basis as exceptions) where applicable for us.
   3. We will not use any Sensitive data e.g. race, religion, political opinions, genetic data, fingerprints, facial recognition, physical or mental health or condition, blood type, medical history, disability, criminal records, and any other similar data, except where we are able to do so under applicable laws or with your explicit consent.
   4. You are responsible for and must ensure that all Personal Data that you provide is true, accurate and complete.
5. HOW WE COLLECT AND RECEIVE PERSONAL DATA

   We may collect and receive your Personal Data via different methods:

   1. (a) Personal Data you provide to us: You may give us your Personal Data directly. This is often the case where you contact us with enquiries, complete forms (e.g. survey form, job application) online or by hand, subscribe to receive our communications or provide feedback to us;
   2. (b) Personal Data we collect from you automatically: We may automatically collect certain technical information about your equipment, browsing history and patterns. We collect this Personal Data by using cookies and other similar technologies; and/or
   3. (c) Personal Data we receive from third parties: From time to time, we will receive Personal Data about you from third parties such as Toyota affiliate companies, subsidiaries, business partners or other companies provided that such companies have the right to disclose your Personal Data to us according to third party’s privacy policy and/or you have provided consent to disclose your Personal Data with such third party as the case may be.


6. PURPOSES AND LEGAL BASIS FOR COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA
   1. We collect, use and disclose the Personal Data for the following purposes (“Purposes”):
      1. (a) To provide services and products to you: such as to enter into a contract and perform our obligations in accordance with any contract that we may have with you or the organization you represent, to support and perform other activities related to services or products;
      2. (b) To manage our relationship with you: such as to contact and communicate with you as requested by you or in relation to the services or products, to facilitate your use of the services and products, to handle your queries, request, obtain feedback or complains;
      3. (c) To improve business operations, services and products: such as to evaluate, analyze, develop, manage, improve, research and develop the business operations of services or products, to identify and resolve issues, to create aggregated and anonymized reports, to measure the performance of our service, to evaluate our employee’s performance on the service, to develop training for our employee;
      4. (d) Communication and Marketing: such as to send you business and marketing communication, press releases, public relations, to send invitation letter to attend the event, to keep you updated on our services and products via channels (e.g. website, email, telephone, fax, post, SMS, MMS, system, and social media channels)
      5. (e) Recruiting and employment relationship: such as to carry out recruitment activities, to respond to your request for a job position, to evaluate your suitability as a job candidate and your qualifications for positions, to determine eligibility for initial employment and verification of references and qualifications, to administer pay, to provide welfares and benefits, to process welfare claims of you and your family (e.g. medical and health related claim), to process work related claims (e.g. transportation), to provide work related services, facilities and equipments, to provide training and/or development course, to conduct performance and competency evaluation, to conduct employee relation activities, to conduct health promotion activities, to conduct internal communication and activity, to carry out planning and analysis for career development, to assess qualifications for a particular job or task, to administer and process your application of visa and work permit, to gather evidence for disciplinary action, or termination, to establish a contact point in the event of an emergency, to comply with applicable labor or employment laws, and such other purposes as are reasonably required by us in connection with your candidacy or employment;
      6. (f) To verify and confirm your identity: such as to register, verify, identify and authenticate you or your identity;
      7. (g) IT Management: such as for business management purpose including for IT operations, management of communication system, operation of IT security and IT security audit, internal business management for internal compliance requirements, policies, and procedures;
      8. (h) Compliance with regulatory and compliance obligations: such as to comply with legal obligations, legal proceedings, or government authorities’ orders which can include orders from government authorities outside Thailand, and/or cooperate with court, regulators, government authorities, and investigating or preventing crime;
      9. (i) Protection of our interests: such as to protect the security and integrity of our business and to exercise our rights or protect our interest where it is necessary and lawfully to do so (e.g. to detect, prevent, and respond to fraud claims, intellectual property infringement claims, or violations of law), to manage and prevent loss of our assets and property, to secure the compliance of our terms and conditions, to detect and prevent misconduct within our premises which includes our use of video record, CCTV and photographing, to follow up on incidents, to prevent and report criminal offenses;
      10. (j) Fraud detection: such as to verify your identity, and to conduct legal and other regulatory compliance checks (e.g. to comply with anti-money laundering regulations, and prevent fraud). This includes to perform sanction list checking, internal audits and records, asset management, system, and other business controls;
      11. (k) Corporate transaction: such as in the event of sale, transfer, merger, reorganization, or similar event we may transfer your Personal Data to one or more third parties as part of that transaction;
      12. (l) Risks: such as to perform risk management, audit performance, and risk assessments; and/or
      13. (m) Life: such as to prevent or suppress a danger to a person’s life, body, or health.
   2. The legal basis for our collection, use, disclosure and/or transferring of your Personal Data is one of the following:
      1. (a) Compliance with a legal obligation to which we are subject;
      2. (b) The performance of a contract to which you or the organization you represent is a party or to process your request for entering into such contract with us;
      3. (c) Legitimate interest, for the purpose of our legitimate interests and the legitimate interests of third parties;
      4. (d) Vital interest, for preventing or suppressing a danger to a person’s life, body, or health;
      5. (e) Public interest, for the performance of a task carried out in the public interest or for the exercising of official authorities; or
      6. (f) In case your consent is required for collection, use, and disclosure of your Personal Data for certain activities, we will first obtain your consent.
   3. In some instances, we may use your Personal Data in ways that are not described above. Where this is the case, we will provide a supplemental privacy notice that explains the relevant information in relation to such use and will obtain your consent first if we required to do so.
   4. In some instances, we have to collect your Personal Data for compliance with laws or performance of a contract and if you fail to provide your Personal Data when requested, we may not be able to process in relation to the related Purpose as described above.
7. DISCLOSURE OF PERSONAL DATA
   1. We may disclose your Personal Data to the third parties who collect, use and disclose Personal Data in accordance with the Purposes under this Policy. You can visit the third party’s privacy policies to learn more details on how they collect, use and disclose your Personal Data as you could also be subject to their privacy policies.
   2. We may disclose your Personal Data in connection with the Purposes to the third parties including:
      1. (a) Toyota affiliate companies: As TDEM is part of Toyota worldwide family, we may need to disclose or transfer your Personal Data to, or otherwise allow access to such Personal Data by other companies within Toyota affiliate companies for the Purposes set out in this Policy including, but not limited to
         1. (1) Toyota Motor Thailand Co., Ltd.
         2. (2) Siam Toyota Motor Co., Ltd.
         3. (3) Toyota Motor Asia Pacific Pte. Ltd. (Singapore)
         4. (4) Toyota Motor Corporation (Japan)
         5. (5) Daihatsu Motor Corporation (Japan)
      2. (b) Our service providers: We may share your Personal Data to our service providers or third party suppliers to perform services on behalf or to assist with the provision of services or products to you including, but not limited to
         1. (1) transportation, warehouse and logistic service providers
         2. (2) research agencies, analytics and survey service providers
         3. (3) marketing, advertising media, event organizers and communications agencies
         4. (4) IT and communication service providers
         5. (5) data storage and cloud service providers
         6. (6) outsourced administrative service providers
      3. (c) Our business partners: Located in Thailand and outside Thailand such as business of manufacturing and sell of vehicles or automotive part (e.g. supplier or dealer), accommodation business or agency, health and insurance business or financial business.
      4. (d) Third parties required by law: In some circumstances, we may be required to disclose or share your Personal Data in order to comply with a legal or regulatory obligation. This includes any law enforcement agency, court, regulator, government authority or other third party where we believe it is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights, the rights of any third party or individuals’ personal safety, or to detect, prevent, or otherwise address fraud, security, or safety issues.
      5. (e) Professional advisors: This includes lawyers, technicians, and auditors who assist in running our business, and defending or bringing any legal claims.
      6. (f) Assignee of rights and/or obligations: In the event of any reorganization, merger, business transfer, whether in whole or in part, sale, purchase, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock or similar transaction.
   3. We may also disclose your Personal Data to third parties where required or permitted by law. Where law requires your consent, we will first ask for it.
8. TRANSFER AND PROTECTION OF PERSONAL DATA
   1. As we are a part of the Toyota affiliate companies, your Personal Data may be transferred to one or more Toyota affiliate companies as needed for data collection, use, and/or disclosure, for the Purposes set forth in this Policy.
   2. When we transfer your Personal Data to Toyota affiliate companies outside Thailand, we will comply with our legal obligations in relation to your Personal Data. We will also take measures to ensure that the foreign recipients put in place appropriate level of protection standard. If required, we will ensure that the foreign recipients protect your Personal Data with a protection standard comparable to the protection under Thai laws.
   3. In the event that we have to transfer your Personal Data to foreign countries where personal data protection standards are inadequate according to the laws, we will first ask for your consent or we will rely on legal basis permitted by laws for transferring your Personal Data outside of Thailand.
9. RETENTION PERIOD
   1. We will retain Personal Data for the period necessary to fulfil the purposes for which the Personal Data was collected and to comply with our obligations under Thai laws. After such period or we are no longer legally obliged to retain your Personal Data, we will delete or destroy such Personal Data without further notice to you.
   2. The retention period will vary depending on the Purposes for which the Personal Data was collected. Where any Personal Data is only useful for a short period e.g. for a specific event or recruitment purposes, we may delete or destroy it at the end of such period.
   3. In some circumstances, you have the right to request us to delete, destroy or anonymize your Personal Data in, except that, we are sometimes legally obliged to retain your Personal Data.
10. YOUR PERSONAL DATA RIGHTS

    Subject to applicable laws and exceptions thereof, you may have the following rights in relation to your Personal Data that we hold. If you wish to make a request to exercise your rights, you can contact us by using our contact details in the “How to Contact Us” section above.

    1. Right of Access
       You may request us to access or request for a copy of the Personal Data we are collecting, using or disclosing about you. We may reject your request where it is permitted by laws or court order, and such request will adversely violate the rights and freedom of others.
    2. Right to Rectification
       You may request us to rectify your Personal Data if the Personal Data we hold about you is inaccurate, not up-to-date or incomplete.
    3. Right to Deletion or Destroying
       You may request us to delete, destroy, or anonymize your Personal Data in certain circumstances, where:
       1. (a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or used;
       2. (b) you withdraw consent on which the collection, use and disclosure is based on, and where we have no legal ground for such collection or use;
       3. (c) you object further collection and use of your Personal Data, and we have no legal ground and exceptions for such collection or use;
       4. (d) the collection, use, or disclosure of such Personal Data is for the purpose of direct marketing; or
       5. (e) the Personal Data have been unlawfully collected, used and disclosed.
       The above does not apply to the extent that such Personal Data retention is necessary for the purpose of compliance or exercise of legal claims, or defense of legal claims, or other purposes permissible by and in compliance with the law.
    4. Right to Restriction
       You may request us to restrict the use of your Personal Data in certain circumstances, where:
       1. (a) you request to rectify your Personal Data to be accurate, up-to-date and complete and we are on process of assessing your request;
       2. (b) you request to restrict of the use of Personal Data which we may unlawfully collected, used, or disclosed instead of deletion or destroying of that Personal Data;
       3. (c) we no longer need your Personal Data for the collected purposes but you require them for the establishment, exercise or defense of legal claims of your interest and benefit;
       4. (d) you request to object the collection, use and disclosure of your Personal Data which we rely on public interest, exercising of official authorities or legitimate interest and we are on process of assessing your request; or
       5. (e) you request to object the collection, use and disclosure of your Personal Data which we rely on carrying out for the purpose of scientific, historical or statistic research and we are on process of assessing your request.
    5. Right to Objection
       You may request us to stop collection, use or disclosure of your Personal Data, where:
       1. (a) we are relying on our own or third party’s legitimate interest to collect, use and disclose of your Personal Data;
       2. (b) we are performing of a task carried out in the public interest or exercising of rights granted by official authorities;
       3. (c) collection, use and disclosure of your Personal Data for direct marketing purpose; or
       4. (d) we are carrying out for the purpose of scientific, historical or statistic research.
       If you object to the collection, use and disclosure, you may request us to delete or restrict the use of your Personal Data.
    6. Right to Data Portability
       You have the right to obtain the Personal Data you have provided to us and request to send or transfer to external party the Personal Data in an electronic format by automated ways unless it is impossible to do so because of our technical restrictions.
    7. Right to Withdraw Consent
       You have the right to withdraw your consent at any time (for the case that you have consented to us) unless there is a restriction of the withdrawal of consent by law, or the contract which gives benefits to you. However, the withdrawal of consent will not affect the collection, use and disclosure of the Personal Data that you have legally given consent.
    8. Right to Lodge a Complaint
       You have the right to lodge a complaint about our practices in collection, use and disclosure of your Personal Data, using the contact details provided in the “How to Contact Us” section above. You may also lodge a complaint with Personal Data Protection Committee.
11. CHANGES TO THIS POLICY
    1. We may make changes to this Policy from time to time to reflect any changes to our use of your Personal Data and as required to comply with changes in applicable laws. We will notify you of any amendments to this Policy via our website.
    2. The latest version of this Policy in force at any given time will apply to our collection, use and disclosure of Personal Data.