This CCTV Privacy Notice shallbecome effective as of August 1, 2025 and was reviewed and revised on August11, 2025
This CCTV Privacy Notice (the “PrivacyNotice”) made by XCMG (Thailand) Company Limited (the “Company”) forcollect, use, store, disclose, process, transfer of Personal Data of the individualsentering and using the Company’s office premises (“you” or the “DataSubject”), under the following terms and conditions:
1. Collectionof Personal Data
1) Company’s CCTV system operatesfor 24 hours and shall be monitored by the Company’s security personnel viadesignated equipment, except in cases where the equipment and/or system ismalfunctioning or undergoing maintenance.
2) The Company will place signsand/or stickers to notify individuals of CCTV usage in appropriate areas withinthe Company’s office premises or any locations where the CCTV system is inoperation.
2. Policyand Purposes for Collection of Personal Data
When you enter the Company’soffice building or any areas under the Company’s control, the Company mayrecord your video, images, or audio which may be identifiable as you, as wellas your personal belongings, such as vehicles, through a closed-circuittelevision (CCTV) system (“CCTV System” or “CCTV Data”).
The data collected through theCCTV System may be considered Personal Data under the Personal Data ProtectionAct B.E. 2562 (2019) (“Personal Data”), and will be collected, used,stored, disclosed, processed, and transferred in accordance with the Company’sstrict security and data protection measures.
The Company may collect, use,store, disclose, process, transfer, and carry out any actions in relation toCCTV Data concerning you. Such actions including, but not limited to,recording, storing, altering, modifying, editing, destroying, transmitting,combining, duplicating, deleting, retrieving, extracting, updating, or addingto such Personal Data. These actions will be undertaken for the “Purposes”specified below, based on lawful grounds such as legitimate interests,protection of life, legal obligations, public interest, your consent, or anyother legal basis as permitted under applicable laws. The Company affirms thatit has no intention to unlawfully infringe upon, violate, or misuse your PersonalData in any way.
Your personal data shall be collected,used, stored, disclosed, processed, and transferred strictly in accordance withthe following purposes:
1) To prevent or mitigate harm ordanger to the life, body, health, and/or personal belongings of you or others;
2) To control access to and fromthe office building and any areas within the Company’s premises for the purposeof security, including preventing damage that may occur to the workplace,buildings, personnel, employees, government officials, visitors, as well asproperty such as equipment, tools, machinery, documents, and Company’s data;
3) To prevent incidents that maylead to business interruptions, intrusions, property damage, theft, and otherforms of criminal activity;
4) To support investigations,resolve disputes and/or complaints arising from disciplinary actions, or toconsider grievances raised by employees, staff, visitors, or other relevantindividuals;
5) To be used as evidence in legalproceedings, including criminal cases, civil cases, administrative cases, andother types of legal actions;
6) To fulfill a contract to whichyou are a party, or to take necessary steps at your request before enteringinto such a contract, including, but not limited to, employment contracts orservice contracts;
7) To carry out tasks in the publicinterest on behalf of the Company, including cooperation with courts,regulatory authorities, government agencies, and law enforcement bodies; and
8) To serve the legitimateinterests of the Company, including, but not limited to, improving business orpolicy efficiency and responding to your requests as the Data Subject.
3. Collectionof Sensitive Personal Data
In certain cases, the Company'sCCTV System may collect your Sensitive Personal Data, such as informationrelating to race, ethnicity, political opinions, religious, sectarian orphilosophical beliefs, sexual behavior, criminal records, health information,disabilities, trade union membership, genetic data, biometric data, or any othersimilar information that may similarly affect you (“Sensitive Personal Data”).The Company affirms that the collection of such Sensitive Personal Data shallbe conducted for legitimate purposes and in accordance with the following legalbases:
(1) Toprevent or suppress danger to your life, body, or health, in cases where youare unable to give consent for any reason whatsoever;
(2) Thedata has been publicly disclosed with your explicit consent;
(3) It isnecessary for the establishment, compliance with, exercise, or defense of legalclaims; and
(4) It isrequired to protect significant public interests, with the Company implementingappropriate measures to safeguard your fundamental rights and interests.
4. Who will receive your Personal Data
The Company shall store yourpersonal data and disclose or transfer such personal data only to specificindividuals who have a duty or necessity to know. The Company may disclose yourpersonal data to its subsidiaries and affiliated companies, including but notlimited to the following:
• XCMG International TradingCorporation (HK) Limited
• XCMG Construction MachineryGroup Import and Export Company Limited
• XCMG Construction MachineryCompany Limited
This includes necessary externalparties, authorized persons, business partners, and/or service providers, whomay be located both domestically and internationally.
5. Transferor Disclosure of Your Personal Data to Foreign Countries
In the event that your Personal Datais transferred to a foreign country, the Company shall only carry out suchtransfer when there is a legal basis to rely upon, such as compliance withcontractual obligations made for your benefit, compliance with legalrequirements, or to protect the legitimate interests of the Company. TheCompany shall consider and conduct the transfer in accordance with theprinciples of necessity and proportionality as prescribed by applicable laws.
However, the destination countryto which the data is transferred may have data protection standards that areeither equivalent to or not equivalent to the standards prescribed under Thailaw. Therefore, the Company places great importance on protecting your PersonalData and will implement appropriate legal, technological, and administrativemeasures to ensure that your personal data is adequately protected and complieswith the requirements of the Personal Data Protection Act B.E. 2562(2019) before any data transfer to such destination country takes place.
6. SecurityMeasures
1) The Company shall implementappropriate technical and administrative measures to ensure the security ofyour Personal Data, including data obtained from the CCTV System and otherrelated Personal Data, to prevent loss, destruction, unauthorized access, use,alteration, or disclosure by any unauthorized persons or without properauthorization. This is to ensure compliance with the principles of Personal Dataprotection as required by law.
2) The Company shall regularlyreview and update its Personal Data security measures as necessary or deemedappropriate, particularly in response to technological changes or emergingthreats that may affect Personal Data.
7. PersonalData Collection Period
Personal data obtained from theCCTV System shall be stored within the Company’s systemfor a period appropriate to the security purpose or as necessary to achieve theobjectives set forth in this Privacy Notice. The retention period will takeinto account standards for maintaining the security and protection of Personal Data,as well as the criteria prescribed by applicable laws.
In cases where data from theCCTV System is related to legal proceedings, such as employee disciplinaryinvestigations or court cases, the Company may retain such data continuouslyuntil the relevant processes are concluded. Upon the expiration of thenecessary retention period, the Company shall securely and properly delete ordestroy the data using safe and standardized methods.
In addition, the Company shallmanage and store such data based on principles of appropriateness andnecessity, strictly in accordance with the requirements of applicable Personal Dataprotection laws.
8. YourPersonal Data related right
Under the provisions of the law,you may have the following rights in relation to your Personal Data:
1) Right to access and rectify PersonalData:You have the right to request access to or correction of any inaccurate orincomplete Personal Data at any time. For the privacy and security of the Data Subject,the Company may require identity verification before providing the requestedperson
2) Right to withdraw consent: If you havepreviously consented to the Company collecting, using, disclosing, processing,and transferring your personal data, you may withdraw your consent at any time.Upon withdrawal, the Company will cease processing the relevant Personal Data,except where the Company has a legal basis to continue such processing.
3) Right to erase, destroy, oranonymize Personal Data: You have the right to request the deletion,destruction, or anonymization of your personal data under the followingconditions:
(1)Whenyou, as the Data Subject, object to the collection, use, disclosure,processing, and transfer of your Personal Data, and such data is no longernecessary for the purposes for which it was collected.
(2)Whenyour Personal Data has been collected, used, disclosed, processed, ortransferred unlawfully.
(3)Whenyou consider that your Personal Data is no longer necessary to be retained, asthere is no legal obligation, legal relationship, or other lawful basissupporting such retention.
(4)Whenyou withdraw your consent to the collection, use, disclosure, processing, andtransfer of your Personal Data, and the Company no longer has any legalauthority to collect, use, disclose, process, or transfer your Personal Data.
4) Right to access and requestcopies:You may submit a request to the Company to obtain a copy of your Personal Dataheld by the Company.
The Company hereby informs youthat exercising your rights as stated above may affect the Company’s ability toprovide you with complete services. The Company may still be required to retainsuch Personal Data if there is a legitimate reason or if permitted by law.
9. Contactus
If you have any questions orconcerns, or wish to exercise your rights regarding CCTV Data, please contactus or our Data Protection Officer at:
Data ProtectionOfficer (DPO)
Tel: 020988088-3
Email: sittichok@xcmg.com
Address: 1000/9 BTSVISIONARY PARK SOUTH TOWER 11 FLOOR UNIT1101-1104 PHAHONYOTHIN ROAD, CHOMPHON, CHATUCHAK 10900
