This Personal Data Protection Policy for Candidates (“Policy”) explains how Tilleke & Gibbins International Ltd. and our Affiliates and Partner Firms (collectively “Tilleke”, “we”, “us” or “our”) collect, use, disclose, transfer, and otherwise process (“process” or “processing”) your Personal Data in the course of our business, in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

We advise you to read this Policy in its entirety.

1. When does this Policy apply to you?

This Policy applies to you if you are a candidate who seeks to apply for employment with Tilleke (“Candidate(s)”).

2. What types of Personal Data does Tilleke collect and process from you?

(a) General Personal Data: Tilleke collects various types of your Personal Data, which can be used to identify you as an individual, whether directly or indirectly (“Personal Data”), including your full name, title, gender, address, email address, contact number, work experience, salary history, educational background, language skills, qualifications, professional experience, professional license number, national identification number, passport number, picture (photo), images and motions captured by video cameras installed at Tilleke’s premises, and any other categories of Personal Data, which you may voluntarily provide to Tilleke when submitting resume or curriculum vitae and any other supporting documents (collectively referred to as the “Job Application”), during your recruitment  process. Tilleke may also keep internal records related to the job applications on the professional competence of the Candidate and related assessment criteria in accordance with our retention policy.

(b) Sensitive Personal Data: During the recruitment process, Tilleke may collect your Personal Data which are categorized as sensitive personal data pursuant to the PDPA, i.e. data pertaining to your health such as medical conditions, weight, height, and any other types of health-related data as may be specified in your medical certificate and/or health check-up result (“Sensitive Personal Data”), in order to assess your eligibility and qualifications for employment with us.

The copy of your Thai national identification card may contain data pertaining to your religious belief and/or blood type which are also considered to be Sensitive Personal Data under the PDPA. Tilleke does not have any intention nor purposes to process such data. Therefore, Tilleke encourages you to blind or cross out such data on your copy of Thai national identification card (i.e. religious belief and/or blood type), before delivering such documents to us. If the copy of your Thai national identification card, which has been delivered to Tilleke, still contains such data, Tilleke will blind or cross it out from the documents ourselves. The blinding or crossing out of such data on the copy of your Thai national identification card will be conducted merely for the purpose of refraining from the collection of any unnecessary or irrelevant Personal Data, and without any criminal intent.

(c) By submitting your Job Application and the Personal Data therein, the Candidate warrants that the Personal Data provided concerns exclusively your Personal Data, or that the Candidate has informed any other person(s), which may include Personal Data of the Candidate’s business or personal references (“Referee(s)”), about the information in relation to the processing of the Personal Data under this Policy and obtained proper and informed consent from such person(s) (if required), or that the collection and disclosure of the Personal Data of the Referee can rely on any other legal bass and that Tilleke is entitled to process the Personal Data of the Candidate’s respective Referee pursuant to the terms of this Policy.

(d) In any event, Tilleke will ensure to retain only your Personal Data which is necessary and relevant for the purposes prescribed herein.

3. Why does Tilleke collect and process your Personal Data? 

(a) Consent:

a. Tilleke processes your Sensitive Personal Data which you may provide to Tilleke via Job Application or during the recruitment process, such as health information, in order to assess your qualifications and eligibility.

b. The Candidate may withdraw his/her consent at any time, subject to the conditions under the applicable laws. Withdrawal of your consent will not affect any processing of your Personal Data for which you have lawfully provided consent prior to such withdrawal.

(b) Contractual Necessity:

a. Tilleke collects and processes your Personal Data to proceed with Candidate’s request to apply for a position with Tilleke whereby the Job Application will be submitted to Tilleke by the Candidate, regardless of its form and channel, such as by sending his/her application to the email address of Tilleke or any of Tilleke’s employees, or by submitting his/her Resume personally at the office of Tilleke, or by submitting his/her Resume to Tilleke via recruitment portal or platform, or via recruitment agencies.

b. Tilleke collects and processes your Personal Data to arrange for interviews and necessary testing in order to assess and determine qualification, suitability, and eligibility of the Candidate for employment with Tilleke.

c. Where the processing of Personal Data relies on contractual necessity as a legal basis, failure to provide required or necessary Personal Data may result in Tilleke being unable to proceed with your request to apply for a position with Tilleke or your requests relating to the recruitment, either in part or in whole.

(c) Legal Obligation:

a. Tilleke collects and processes your Personal Data to comply with applicable law or regulation and to comply with order of the court, competent authorities, and/or government agencies.

b. Where the processing of Personal Data relies on legal obligation as a legal basis, failure to provide required or necessary Personal Data may result in Tilleke being unable to proceed or undertake any act relating to the recruitment process, either in part or in whole. Further, it may cause Tilleke and/or the Candidate to be in violation of applicable law or regulation, or order of the court, competent authorities, and/or government agencies.

(d) Legitimate Interest:

a. Tilleke collects and processes your Personal Data to contact and communicate with the Candidate throughout the recruitment process.

b. Tilleke collects and processes your Personal Data to undertake the identification and verification process and conduct other administration and management work in relation to the recruitment process. These include, without limitation, contacting and communicating with the Referee whose Personal Data are provided by the respective Candidate. 

c. Tilleke collects and processes your Personal Data to detect and prevent fraud or other criminal activity and to protect property, personnel, rights, and interests of Tilleke, including the processing of your images and motions captured and recorded by video cameras which are installed at our premises.

d. Tilleke collects and processes your Personal Data to retain your Job Application and any other Personal Data voluntarily provided to Tilleke during the recruitment process in Tilleke’s files in case there is any future employment opportunity which Tilleke determines may suit the eligibility and qualifications of the Candidate. In such case, Tilleke will process your Personal Data in order to contact and communicate with you on such employment opportunity.

e. Tilleke collects and processes your Personal Data to perform recruitment for the position for which the Candidate has applied, as well as documentation of the selection process.

f. Tilleke collects and processes your Personal Data to negotiate, plan, or undertake necessary activities in relation to restructuring of the business of Tilleke (if any).

(e) Legal Claims: Tilleke collects and processes your Personal Data to process Personal Data of the Candidate when it is necessary for the establishment, compliance, exercising, or defense of legal claim by Tilleke.

4. Where does Tilleke collect your Personal Data?

(a) Candidates

a. Directly from you: We normally collect your Personal Data directly from the Candidate, when you contact, communicate, or correspond with us either via email or through direct interaction. For example, we may collect your Personal Data when you apply for an employment position with us via online channel or in person.

b. Referring persons: We may collect your Personal Data from other persons, such as our employees in case of referral.

c. Third Parties: We may also collect your Personal Data from online public sources (such as LinkedIn), third-party vendors who provide services relating to personality/aptitude tests, recruitment agencies, hospitals, court orders, court judgments, orders of the competent authorities, and any other governmental agencies.

(b) Referees 

We collect your Personal Data from your respective Candidate.

5. To whom does Tilleke disclose your Personal Data?

(a) Tilleke may disclose Personal Data of the Candidate to our Affiliates and Partner Firms, both within and outside Thailand, for the purpose relating to your recruitment and prospective employment. 

(b) Tilleke will not disclose Personal Data of the Candidate to any third parties, unless you give consent or we can rely on other legal basis to do so in order to progress your application for employment (e.g., hospital and personality/aptitude test service provider) or unless your application for employment with Tilleke is successful.

(c) Tilleke may disclose Personal Data of the Candidate to any other persons or entities to whom Tilleke is required to make disclosure by applicable law, including order of the court or competent authority.

6. Where does Tilleke transfer your Personal Data?

(a) We regularly transfer your Personal Data to our Affiliates and Partner Firms, and in certain circumstances, to third parties (e.g. service providers), which are located outside Thailand, and which may have different data protection standards to those prescribed by the data protection authority in Thailand. Notwithstanding that, we ensure that we will protect your Personal Data by implementing adequate personal data protection standards for the transfer of your Personal Data outside Thailand. We will also ensure that any entity to whom your Personal Data will be disclosed will implement adequate personal data protection standards, and where your Personal Data will be transferred within our Affiliates and Partner Firms, we will use the relevant data transfer mechanisms (e.g. binding corporate rules or any other means prescribed by applicable data protection law). In addition, your Personal Data is primarily transferred to our Affiliates and Partner Firms, which are located in Cambodia, Indonesia, Laos, Myanmar, and Vietnam.

(b) In all cases, we will transfer your Personal Data only where it is permitted and in compliance with the PDPA.

7. For how long does Tilleke retain your Personal Data?

(a) For an unsuccessful Candidate, Tilleke will retain your Resume and Personal Data provided during the recruitment process for 10 years after the end of your recruitment process. Thereafter, Tilleke will securely delete, destroy, or de-identify your Personal Data.

(b) For a successful Candidate, Tilleke will transfer your Personal Data, including Sensitive Personal Data, provided during the recruitment process to the file designated for a Tilleke employee. The retention period for your Personal Data and Sensitive Personal Data will be in accordance with the Personal Data Protection Policy for Employees, which will be provided to you after the completion of the recruitment process.

8. What are your rights in relation to your Personal Data?

You are entitled to: 

(a) Request to have access to and obtain a copy of your Personal Data, and to request the disclosure of the source of the Personal Data, in the event that your Personal Data was collected without your consent;

(b) Receive your Personal Data in a commonly used and machine-readable format (if any), and to have your Personal Data in said format transmitted to another Data Controller;

(c) Request that your Personal Data be deleted, destroyed, or de-identified;

(d) Object to the collection, use, and disclosure of your Personal Data;

(e) Request that the processing of your Personal Data be suspended;

(f) Request that your Personal Data be corrected, updated, or completed;

(g) Withdraw your consent at any time, provided that there is no other legal ground for Tilleke to continue with the processing of your Personal Data; and 

(h) Lodge complaints to the Office of Personal Data Protection Commission and any other competent authorities

Your request may be refused, and the exercise of your rights is subject to the conditions and limitations prescribed by law.

9. Changes to this Policy

Tilleke may amend, change, or update this Policy from time to time, whereby Tilleke will notify you about such changes via your selected communication channel or any other communication channels as Tilleke deems appropriate. In the event that the amendment, change, or update will affect the purposes for which your Personal Data has originally been collected, Tilleke will notify you about such changes and obtain your consent (if applicable), prior to such changes becoming effective.

10. How can you contact us?

If you have any inquiries in relation to your Personal Data, or you would like to exercise any of your rights, you may contact us at:

Tilleke & Gibbins International Ltd.

Supalai Grand Tower, 26th Floor

1011 Rama 3 Road, Chongnonsi, Yannawa

Bangkok 10120, Thailand

T: +66 2056 5555

F: +66 2056 5678

Email: [email protected]

Or you may contact our Data Protection Officer at: 

Papitchya Supinananda

T: +66 2056 5555

F: +66 2056 5678

Email: [email protected]

This Policy is effective from June 1, 2022, onward.