Latest update May 2022

KASIKORNBANK PCL (“KBank”) operates its business in adherence with ethical standards and respect for your privacy. KBank has always placed importance on personal data protection and security of applicants and personnel of KBank to ensure that personal data obtained by KBank will be used in accordance with the objectives and in compliance with law. KBank has formulated this Personal data protection policy (the “Policy”) to inform you, as a Data Subject, of the objectives and details for collection, use and / or disclosure of personal data, including your legal rights.

1. To whom will this Policy apply, and what are channels for personal data collection ?

   This Policy is intended to inform you, applicants and personnel of KBank, whether being job applicants, scholarship applicants, scholarship recipients, directors, advisors, experts, employees or students under KBank’s internship program, including their family members, beneficiaries under welfare programs, emergency contact persons and reference persons, of objectives and details about collection, use and / or disclosure of your personal data including your legal rights related to the personal data which KBank has collected, used and / or disclosed for the purpose of job application, scholarship application, receipt and payment of scholarship, internship or employment.

   Your personal data which KBank has collected, used and / or disclosed, other than that obtained from the process regarding job application, scholarship application, receipt and payment of scholarship, internship or employment, shall not be under the scope of the use of this Policy; for instance, your personal data that has been collected, used and / or disclosed by KBank for the use of products or services provided by KBank.

2. What kinds of personal data are to be collected, used and / or disclosed ?
   1. 2.1 Personal data refers to any information that can be used to confirm your identity, either directly or indirectly (excluding information of the deceased), which is :
   2. 2.1.1 Personal data which you have directly provided to KBank, including the data collected from job/scholarship application form and interview, as well as the data collected during the scholarship program, the internship program or the employment or from various contacts such as from branches or head office, one-on-one meeting, website, email, online social media, telephone, facsimile or postal mail.
   3. 2.1.2 Personal data which KBank has obtained or gained access to from other sources, not directly from you, such as government agencies, other companies within KASIKORNBANK FINANCIAL CONGLOMERATE, financial institutions, financial service providers, business partners, credit information companies and data service providers, advisors, associations and other public data sources.
   Your personal data that KBank collects, uses, and / or discloses includes :

1. 2.2 Sensitive Personal Data

   “Sensitive personal data” refers to personal information which is specifically determined by law; KBank has no intention of collecting your sensitive personal data.

   In certain cases, however, KBank may be required to collect sensitive personal data from you for consideration of your employment and request for scholarship, action taken under the contract entered into by KBank with you or for compliance with law. Sensitive personal data collected by KBank includes religion, criminal record (such as result of examination into criminal record obtained from competent authorities), health data (such as health checkup result, physician’s certificate, medication history, vaccination history, KBank’s medical record data, psychological test result), disability (such as national ID card of the disabled), labor union data, biometric data (such as facial, fingerprint and iris recognition). KBank shall collect, use and / or disclose the sensitive personal data provided that KBank has been given explicit consent from you or as required and permitted by law. This shall be undertaken on a case-by-case basis when KBank is required to collect sensitive personal data from you.

   (Unless specifically stated otherwise, personal data and sensitive personal data as earlier mentioned shall hereinafter be collectively referred to as “Personal Data.”)

2. 2.3 Personal Data of minors, incompetent or quasi-incompetent persons

   KBank has no intention of collecting, using and / or disclosing Personal Data of minors, the incompetent or quasi-incompetent persons, unless consent from the guardian, protector or curator (as the case may be) is given. If KBank learns that the collection, use and / or disclosure of Personal Data of minors, the incompetent or quasi-incompetent persons is undertaken without consent given by the guardian, protector, and / or curator, KBank shall delete or destroy such Personal Data immediately, or the collection, use and / or disclosure of the Personal Data shall be undertaken only for the cases where KBank can apply other legitimate bases that require no consent.

3. 2.4 Personal data of any other third party

   If you are the provider of Personal Data of any other third party such as family members, beneficiaries of welfare benefits, emergency contact person and reference person, please inform those persons of the details under this Policy and request their consent, if necessary, or apply other legal bases to ensure that KBank can collect, use and / or disclose Personal Data of the aforementioned third party.

3. What are the objectives of collection, use and / or disclosure of your Personal Data ?

   KBank will collect, use and/or disclose your Personal Data only as necessary under KBank’s legitimate objectives. Legal bases that KBank may use as reference for collecting, using or disclosing your Personal Data include: (1) Contractual basis; (2) Consent; (3) Vital interest; (4) Legal obligations; (5) Legitimate interest, and/or other legal bases that KBank can use in accordance with applicable law.

   Please consider the following objectives which may be applied to you based on your relationship with KBank.

   1. 3.1 In case you are a job applicant, intern, director or employee of KBank
   2. 3.1.1 Objectives requiring consent - In collecting, using and / or disclosing the following sensitive personal data, KBank cannot use other legal bases but must request explicit consent for such objectives.
      1. (1) Religion data for consideration and approval of ordination leave / Hajj leave / food preparation / religious rites in case of death, etc.
      2. (2) Biometric data for identity verification and confirmation, work attendance, meeting attendance, training and seminar, participation in activities, events or building entrance
      3. (3) Health record data for job recruitment, granting of welfare (such as medical expense disbursement, insurance payment, medical treatment at KBank’s nursing room, vaccination service or transfer to hospital admission) loan for medical treatment, work permit renewal for foreign employees in support of their leave and / or human resource management in case of long-term leave for medical treatment
      4. (4) Criminal record for job recruitment and qualification examination
      5. (5) Disability data for arrangement of welfare for the disabled
      6. (6) Labor Union data for labor relations and management
   3. 3.1.2 Objectives requiring legal bases other than consent
      1. (1) Consideration, selection and employment such as employee recruitment, identity verification and authentication, data and document verification, operations related to the applicant screening process (such as considering applicant qualifications, conducting an interview and a written examination), communications, entering into a contract and / or related juristic acts, recruitment-related operations (such as making an employee ID card, employee registration, preparing employee data, providing office equipment), compliance with the contract to which you are a party, or to proceed with the request / your application prior to entering into the contract
      2. (2) Human resource management such as arrangement of employee database and profiles, provision of work facilities, arrangement of related meetings, use of your data for conducting KBank’s transactions, facilitating the discharge of duties of KBank’s directors, coordinating with external service providers, business partners or public agencies (such as submission of employee data to hospitals or public agencies for vaccinations), record of working hours, leave of absence, promotion, job transfer, change in position, organizational restructuring, performance management and evaluation, and personality assessment, competency assessment, leadership assessment and cultural assessment
      3. (3) Payments of wages and other types of remuneration such as arrangement of welfare or other benefits, consideration and payment of salaries, employee welfare rights (such as disbursement of an advance payment, group insurance and air travel insurance)
      4. (4) Skill and ability development such as arrangement of training session, personnel development, and promotion of learning among employees
      5. (5) Labor relations such as KBank - employee relationship management, arrangement and presentation of souvenirs to employees, arrangement of activities, employee feedback and engagement surveys
      6. (6) Other operations of KBank such as job assignments to KBank’s representatives, examination of data related to the use of electronic equipment in order to enhance work efficiency or examine job performance, cyber threats, violation of various laws as part of the arrangement of advertisement, media and internal and external corporate communications, sound recording, picture taking, CCTV recording, any operation related to supervision and audit, anti-corruption, disciplinary investigation, complaint handling, disciplinary action and / or employment termination, enterprise risk management, supervision and audit, corruption management, prevention, handling and mitigation of risks that may arise from corruption, management in the organization and financial conglomerate, analyses, research, preparation of statistical data and reports for internal use and submission to external agencies, preparation of anonymous data, taking legal action or other legal processes, compliance with the relevant laws and / or policies established by KBank and other operations related to employment termination
      7. (7) Compliance with the order of competent authorities and / or compliance with laws such as orders of the courts, government agencies, banking supervisory agencies, competent government officials, the Personal Data Protection Act, Civil and Commercial Code, financial institution business law, securities and stock exchange law, insurance law, labor protection law, social security law, workmen’s compensation law, labor relations law, provident fund law, taxation law, bankruptcy law, anti-money laundering law, law pertaining to Anti-Money Laundering, Combating the Financing of Terrorism and the Proliferation of Weapons of Mass Destruction, computer law, and other laws with which KBank is required to comply, either in Thailand or other countries, including announcements and procedures issued under these laws, which are now being enforced, to be amended or to be enforced in the future

1. 3.2 If you are an applicant or recipient of KBank Young Scholarship
2. 3.2.1 Objectives requiring consent - The collection, use and / or disclosure of sensitive Personal Data for which KBank cannot rely on other legal bases apart from requesting explicit consent. Such objectives are as follows :
   1. (1) Medical history data for the consideration of scholarship applications
   2. (2) Criminal record for the consideration of scholarship applicants
   3. (3) Data on religion (per copy of National ID card; KBank is required to use such data as evidence of identity verification and authentication only, and shall not otherwise use and / or disclose it)
3. 3.2.2 Objectives requiring legal bases other than consent
   1. (1) Preparation of database and profiles of scholarship recipients
   2. (2) Identity verification and authentication
   3. (3) Compliance with laws and / or policies established by KBank
   4. (4) Other operations as part of the consideration for receiving KBank scholarship
4. 3.3 If you are an advisor / expert
5. 3.3.1 Objectives requiring consent - The collection, use and / or disclosure of sensitive Personal Data for which KBank cannot rely on other legal bases apart from requesting explicit consent. Such objectives are as follows :
   1. (1) Data on religion (per copy of National ID card; KBank is required to use such data as evidence of identity verification and authentication only, and shall not otherwise use and / or disclose it)
   2. (2) Medical history data for the renewal of a work permit if an advisor is a foreign national
6. 3.3.2 Objectives requiring legal bases other than consent
   1. (1) Identity verification and authentication
   2. (2) Invitation and hiring (such as selection of experts / advisors, entering into a contract or related juristic act and cost management)
   3. (3) Compliance with laws and / or policies established by KBank
   4. (4) Other objectives as part of KBank’s operations (such as the use of names or photos of experts / advisors to promote related activities or seminars)

7. If KBank is required to collect, use and / or disclose your Personal Data for entering into or complying with the contract that you have entered into with KBank and / or complying with the relevant laws, and you do not provide such necessary Personal Data to KBank upon request, KBank may not be able to proceed per your request or the contract, thus affecting KBank’s compliance with the relevant laws or relationship between you and KBank.

4. To whom will your Personal Data be disclosed ?

   KBank may disclose your Personal Data to a third party under your consent or the criteria permitted by law. Persons or agencies receiving said data shall collect, use and / or disclose your Personal Data within the scope for which you have given consent or within the scope related to this Policy. In certain cases, you may be under the Personal Data Protection Policy of the recipient of Personal Data, and the recipient of your Personal Data may be in Thailand or other countries.

   KBank may disclose your Personal Data to other persons or agencies, as follows :

5. Will KBank send or transfer your Personal Data to other countries ?

   KBank may find it necessary to send or transfer your Personal Data to other companies within KASIKORNBANK FINANCIAL CONGLOMERATE in other countries, or to other data recipients, as part of KBank’s normal business operations. For instance, Personal Data may be sent or transferred for storage on cloud platforms or servers in various countries, or to KBank’s counterparties abroad and / or government agencies abroad.

   If the destination country fails to meet the given standards for data protection, KBank must ensure that Personal Data will be sent or transferred in accordance with legal requirements, while Personal Data protection measures will be put in place, appropriate for and consistent with the confidentiality standards. For instance, an agreement must be entered into with the data recipient in that country to ensure that your Personal Data will be protected under the personal data protection standard equivalent to that in Thailand. If the data recipients are other companies within KASIKORNBANK FINANCIAL CONGLOMERATE, KBank may ensure that binding corporate rules verified and certified by relevant competent authorities are in place, and shall send or transfer Personal Data to other companies within KASIKORNBANK FINANCIAL CONGLOMERATE abroad in accordance with said binding corporate rules.

6. How long does KBank keep your Personal Data ?

   KBank will safeguard your Personal Data during the period in which you are KBank personnel or have another relationship with KBank, or for the duration necessary to achieve the relevant objectives of this Policy. Once your relationship with KBank ends, KBank will further retain your Personal Data for an additional period thereafter as required according to the statute of limitations or for a period as required or permitted by law, for example :

   1. a. Unqualified job applicant : Your Personal Data will be kept and safeguarded for three years as evidence to prove that the job screening process has been undertaken by KBank with fairness and for further consideration of matching your application with other job positions available in the future.
   2. b. Unqualified scholarship applicant : Your Personal Data will be kept and safeguarded for one year.
   3. c. Other employee / personnel : Your Personal Data will be kept and safeguarded in accordance with labor laws and other applicable laws for the purpose of proof and investigation, in case there is any dispute arising within the statute of limitation period set by applicable law, which shall, however, be no more than 10 years.

   4. KBank will undertake operations through appropriate steps to delete or destroy Personal Data or make it anonymous when it is no longer necessary or the said period ends.

7. How does KBank protect your Personal Data ?

   KBank shall apply technical, administrative and physical measures for safeguarding your Personal Data in order to maintain confidentiality, accuracy and completeness, and availability of Personal Data to prevent unauthorized or illegitimate access, collection, revision, rectification, use and / or disclosure of Personal Data, in accordance with legal requirements.

   KBank has put in place appropriate measures that safeguard against Personal Data breaches. KBank has therefore established policy, procedures and criteria on Personal Data protection. These include measures to control access to Personal Data, and the secure and proper use of devices for storing and processing Personal Data, restriction of access to Personal Data, determination of right to access users’ Personal Data, and authorization for employees assigned to access data and users’ responsibilities. All of these measures are intended to prevent unauthorized access to Personal Data, unauthorized disclosure or copying of Personal Data, or theft of devices used in the storing or processing of Personal Data. Measures have thus been put in place for tracing back access, change to, deletion or transfer of Personal Data, which are appropriate for and correspond to the methods and tools for collection, use or disclosure of Personal Data, including examination for assessing the effectiveness of compliance with policies, procedures and regulations for Personal Data protection.

   KBank’s executives, employees, personnel, contractors, representatives, advisors, and recipients of data from KBank shall maintain the confidentiality of the Personal Data in accordance with the confidentiality measures determined by KBank.

8. What are your rights in connection with your Personal Data ? Your rights under this section are legal rights that you should be aware of. You may exercise your rights under legal requirements and policies currently available, or to be amended in the future, and criteria determined by KBank. If you are less than 20 years old, or have limited capacity to perform juristic acts under the law, you may have your father or mother, guardian or authorized person express the intention to exercise these rights on your behalf.
   1. 8.1 Right to revoke consent : You are entitled to revoke the consent that you have given to KBank to collect, use and / or disclose your Personal Data (whether such consent is given prior to or after enforcement of the Personal Data Protection Law), at any time during which your Personal Data is held at KBank, unless there is right restriction by law; or there is any existing contract which remains beneficial to you. The collection, use and/or disclosure of your Personal Data that was undertaken prior to the revocation of consent shall not be affected. However, the revocation of your consent in matters related to and necessary for the operations may result in KBank’s inability to perform in compliance with the contract or provide you with welfare benefits, or termination or suspension of related activities, or otherwise have an impact on you. For your own benefit, please study and / or inquire into the potential impacts before deciding to revoke your consent.
   2. 8.2 Right to access : You are entitled to have access to your Personal Data maintained under KBank’s responsibility and to request that KBank provide you duplication of said data and inform you of how your Personal Data has been obtained.
   3. 8.3 Right to data portability : You are entitled to request to obtain your Personal Data if KBank organizes such Personal Data in a format that can be read or used with an automated device or equipment, and can be used or disclosed via automated methods. You are entitled to request KBank to send or transfer your Personal Data in the said format to other data controllers if doable by automatic means; and to request to obtain the Personal Data in such format sent or transferred by KBank directly to other data controllers unless not technically feasible.
      Your aforementioned Personal Data must be that under your consent granted to KBank to collect, use and/or disclose, or must be Personal Data that KBank is required to collect, use and / or disclose to allow you to use KBank’s products and / or services in accordance with your intention wherein you are a contract party with KBank, or to undertake operations per your request before using KBank’s products and / or services, or it must be other Personal Data as determined by competent authorities.
   4. 8.4 Right to object : You are entitled to lodge an objection against the collection, use and / or disclosure of your Personal Data, at any time, in case the collection, use and / or disclosure of your Personal Data is undertaken for necessary operations within the legitimate interest of KBank, or a person or any juristic person, or for undertaking operations for public interest. If you lodge an objection, KBank shall continue to collect, use and / or disclose your Personal Data only if KBank can provide legal reasons that the collection, use and / or disclosure of your Personal Data is deemed sufficiently important, or is undertaken for the establishment, compliance, exercising or defense of legal claims in compliance with the laws, as the case may be.
   5. 8.5 Right to erasure or right to be forgotten : You are entitled to request the deletion, destruction, or anonymization of your Personal Data if you believe that your Personal Data has been collected, used and/or disclosed illegitimately, which is not in compliance with applicable laws, or if you deem that it is no longer necessary for KBank to retain the data per the relevant objectives of this Policy, or when you exercise your right to revoke consent or your right to object as mentioned earlier.
   6. 8.6 Right to restrict processing : You are entitled to request KBank to temporarily stop using your Personal Data, in case KBank is in process of conducting an investigation per your request to exercise the right to rectification or the right to object, or in any other cases where it is no longer necessary for KBank to retain your Personal Data and KBank is obliged to delete or destroy the Personal Data in accordance with applicable laws, but you prefer to exercise the right to restrict processing instead.
   7. 8.7 Right to rectification : You are entitled to rectify your Personal Data to keep it accurate, up-to-date, complete and not misleading.
   8. 8.8 Right to lodge a complaint : You are entitled to lodge a complaint to relevant competent authorities if the collection, use and/or disclosure of your Personal Data violates or does not comply with applicable laws.

   Your exercising of the aforementioned rights may be restricted by applicable laws, and in certain cases, there may be compelling reasons that may cause KBank to deny your request or may prevent KBank from complying with your request, such as compliance with laws or court orders, public interest, or potential violation of other persons’ rights or freedom. If KBank opts to deny said request, KBank shall inform you the reason(s) for such denial.

9. Will KBank add to, rectify or revise this Privacy Policy ?

   KBank may consider adding to, rectifying or revising this Policy from time to time, as deemed appropriate and permitted by law. In case of addition to, rectification or revision of this Policy, KBank will announce the current Policy on the Company’s website at https://www.kasikornbank.com/en/privacy-policy/Pages/privacy-policy-data-personal.aspx

10. How can you contact KBank and the responsible Personal Data Controllers ?

    If you have any suggestions or enquiries regarding details of the collection, use and / or disclosure of your Personal Data, or would like to exercise the rights under this Policy, you may contact KBank and / or the responsible Personal Data Controllers via the following channels :

    • Responsible Personal Data Controller, Human Resource Division
      Contact Address : KASIKORNBANK PCL No.1 Soi Rat Burana 27/1, Rat Burana Road, Rat Burana Sub-district, Rat Burana District, Bangkok 10140
      Email : HREDataProtection@kasikornbank.com
    • Responsible Personal Data Controller
      Contact Address : KASIKORNBANK PCL No. 1 Soi Rat Burana 27/1, Rat Burana Road, Rat Burana Sub-district, Rat Burana District, Bangkok 10140
      Email : DataProtectionOfficer@kasikornbank.com