Privacy Policy
NEP Realty and Industry Public Company Limited recognizes the importance of protecting the personal data of its business partners. Accordingly, the Company has established this Personal Data Protection Policy for Business Partners with the aim of overseeing and managing the personal data of authorized representatives, directors, shareholders of business partners, and other contact persons whose information has been provided to the Company.
This policy also serves to inform you of your rights as stipulated under the Personal Data Protection Act B.E. 2562 (2019).
The Company collects, uses, and/or discloses your personal data as a result of your business relationship with the Company and/or your role as an employee, representative, or agent of such business partner.
- Types of Personal Data Collected by the Company
“Personal Data”refers to any information relating to an individual that enables the identification of such individual, whether directly or indirectly.
This does not include information of deceased persons. The Company may collect various types of personal data, including but not limited to the following:
Personal Information: This includes, for example: name prefix – full name, gender, age, date of birth, nationality, marital status, photographs, videos, CCTV footage, educational background, employment or business affiliation (e.g. the company you work for, are employed by, or are a business partner of), copies of identification documents (e.g. national ID card, passport, household registration), financial status, government-issued documents, vehicle information, signature, bank account and payment information, electronic signatures, and other identification documents.
Contact Information: This includes, for example: telephone number, mobile phone number, fax number, address, email address, Line ID, and other similar contact details.
Other Information: This includes information relating to the business relationship between the Company and its business partners, such as data you provide to the Company as specified in contracts, forms, surveys, or other documents; transaction-related data between you and the Company; and computer system records, among others.
Personal Data of Other Individuals Related to You: This includes information that identifies your spouse or children, information of employees of a company related to you, and any other personal data of third parties that you have provided to the Company in any form. By providing such third-party personal data to the Company, you represent and warrant that you are authorized to do so and that you permit the Company to use such personal data in accordance with this Privacy Policy. You are also responsible for informing such individuals of this Privacy Policy and/or obtaining their consent, as required.
Sensitive Personal Data: This includes, for example: race as shown in identification documents; religion indicated on the national ID card; labor union information; biometric data such as fingerprints, facial recognition, or iris recognition data; health or physical/mental condition information; criminal records; and any other data of a similar nature as prescribed by the Personal Data Protection Committee.
- The Company collects your personal data through the following channels:
- Data provided directly by you or through contracts or form submissions:
This includes data you provide when you conduct business or enter into transactions with the Company, or when you interact with the Company directly — including interactions via the Company’s online platforms, websites, or mobile applications. It also covers communications through email, telephone, surveys, business cards, postal mail, as well as during meetings and events. Data from business partners for whom you work, act on behalf of, or represent.
Data from the Company’s group of companies, shareholders, or third parties, such as other business partners or representatives
- Data from electronic file sources
- Data provided directly by you or through contracts or form submissions:
- Use of Your Personal Data
The Company will collect, use, and/or disclose your personal data in accordance with the nature of your relationship with the Company, for legitimate purposes based on contractual obligations or other legal grounds, and in compliance with the Personal Data Protection law, ministerial regulations, ministerial notifications, or any other applicable laws and regulations.
Disclosure of Your Personal Data
The Company will not disclose your personal data to any third party, except where it is necessary for the Company’s operations and not in violation of applicable laws. Such parties may include the Company’s shareholders, other business partners, and external service providers engaged by the Company—such as cloud service providers, data analytics providers, and professional advisors. These advisors may include legal counsel, technical experts, and other parties supporting the Company’s business operations or legal rights.
In certain cases, the Company may be required to disclose your personal data in order to comply with applicable laws or regulations. This includes disclosures to law enforcement authorities, courts, government agencies, or other third parties if the Company believes such disclosure is necessary to comply with legal or regulatory obligations, to protect the rights of the Company, the rights of third parties, or the safety of individuals; or to detect, prevent, or address fraud, security, or safety issues.
In addition, your personal data may be disclosed in the course of a transfer of rights or similar transactions, whether in whole or in part, to assignees and/or transferees of the Company’s rights and obligations. The Company may also disclose your personal data in emergency situations to protect your vital interests.
- Cross-Border Transfer of Personal Data
The Company may transmit or transfer your personal data to its affiliates or other parties located in foreign countries when necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract, or for the performance of a contract between the Company and another person or legal entity for your benefit.
Such transfers may also occur for the purpose of preventing or suppressing danger to your life, body, or health or that of others, for compliance with legal obligations, or where necessary for the performance of a task carried out in the public interest.
The Company may store your personal data on computer servers or cloud systems provided by third parties. It may also use third-party software or applications in the form of Software as a Service (SaaS) or Platform as a Service (PaaS) for the processing of your personal data.
However, the Company does not permit unauthorized persons to access your personal data and requires such third parties to implement appropriate security and protection measures.
In cases where your personal data is transferred to a foreign country, the Company will comply with applicable personal data protection laws and implement appropriate measures to ensure that your personal data is protected and that you can exercise your rights under the law.
The Company will also require data recipients to implement appropriate data protection measures and to process your personal data only as necessary. Measures will be taken to prevent unauthorized use or disclosure of your personal data.
- Retention Period of Your Personal Data
The Company will retain your personal data only as necessary for the purposes for which it was collected, used, or disclosed, and within the scope of such purposes.
Unless otherwise exempted by the Personal Data Protection Act B.E. 2562 (2019) or other applicable laws, the Company may be required to retain your personal data for a longer period than legally prescribed, where necessary.
- Your Rights as a Data Subject Subject to the conditions prescribed by law, you are entitled to the following rights:
- Right of Access: You have the right to access and obtain a copy of your personal data held by the Company, and to request disclosure of the source of your personal data if it was collected without your consent.
- Right to Rectification: You have the right to request the correction of your personal data to ensure that it is accurate, up-to-date, complete, and not misleading.
- Right to Erasure: You have the right to request the deletion or destruction of your personal data, or the anonymization of such data so that it can no longer be used to identify you.
Right to Data Portability:
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit or transfer such data to another organization. This applies to personal data that:You have provided to the Company; and
The Company has obtained your consent to collect, use, or disclose, or where such processing is necessary for the performance of a contract to which you are a party.
- Right to Object: You have the right to object to the collection, use, or disclosure of your personal data by the Company, or to request the suspension of the processing of your personal data.
Right to Withdraw Consent: You have the right to withdraw your consent to the collection, use, or disclosure of your personal data at any time, where the processing is based on your consent.
Right to Lodge a Complaint: You have the right to lodge a complaint with the competent authority if you believe that the collection, use, or disclosure of your personal data is unlawful or not in compliance with the applicable data protection laws.
If you wish to exercise any of the rights mentioned above, please contact the Company via the “Company Contact Channels” provided below. The Company will consider your request and inform you of the result within 30 days from the date of receipt.
Please note that the Company may reject your request if there are legal grounds to do so.
However, the exercise of your rights shall not affect the collection, use, or disclosure of personal data that you have previously provided to the Company. In the event that any damage arises from such data, you shall be solely responsible for such consequences.
- Data Security Measures
The Company has implemented appropriate personal data security measures, which include administrative, technical, and physical safeguards to control and restrict access to personal data. These measures are designed to prevent unauthorized loss, access, use, alteration, modification, or disclosure of personal data.
The Company has implemented access control and restriction measures for personal data and the use of devices used to store and process such data securely. These measures include defining user access rights, responsibilities, and restricting or assigning access permissions only to authorized personnel, in order to prevent unauthorized access, disclosure, awareness, duplication, or theft of personal data or the devices used to store or process such data.
In addition, the Company has established regular audit and monitoring procedures related to the access, modification, deletion, or transfer of personal data.
- The Company may amend or update this Privacy Policy.
Such amendments may be made from time to time to reflect changes in laws, technological developments, or other legitimate reasons as deemed necessary. The amended Privacy Policy will be published on Privacy Policy prior to its effective date.
- Company Contact Channels You may contact the Company using the following contact details:
Company Contact Channels Data Protection Officer (DPO)
- Contact Address: NEP Realty and Industry Public Company Limited
Head Office: 41 Phahonyothin 5 Alley, Phahonyothin Road, Phaya Thai Subdistrict, Phaya Thai District, Bangkok 10400, Thailand
Factory: Navanakorn Industrial Promotion Zone, Nakhon Ratchasima 999/5 Moo 1, Mittraphap Road, Naklang Subdistrict, Sung Noen District, Nakhon Ratchasima 30380, Thailand
- Contact Channels: Privacy Center: +66 44 335 520 ext. 110, 103
Email: [email protected]
NEP Realty and Industry Public Company Limited recognizes the importance of protecting the personal data of our business partners. The Company has established this Privacy Policy for Business Partners to govern and manage the personal data of authorized representatives, directors, shareholders of business partners, and other contact persons provided to the Company. We hereby inform you of your rights as prescribed under the Personal Data Protection Act B.E. 2562 (2019) (PDPA).
The Company collects, uses, and/or discloses your personal data by virtue of your business relationship with the Company, and/or in your capacity as an employee, authorized representative, or agent of such business partners.
“Personal Data” refers to any information relating to you that enables your identification, whether directly or indirectly, excluding the information of deceased persons. The Company may collect various categories of personal data, including:
Personal Identification Information: such as title, first name, last name, gender, age, date of birth, nationality, marital status, photographs, video recordings, CCTV footage, educational background, and information regarding the company you work for, are employed by, or hold shares in. This also includes copies of identification cards, passports, and house registration; financial status; information from government documents; vehicle information; signatures (including electronic signatures); bank account and payment details; and other identification documents.
Contact Information: such as telephone number, mobile number, fax number, physical address, email address, Line ID, and other similar contact details.
Other Information: related to the relationship between the Company and its business partners, such as information provided in contracts, forms, surveys, or other documents; transaction history with the Company; and computer log data.
Personal Data of Third Parties Related to You: such as identification of your spouse or children, information about Company employees related to you, and any other data concerning individuals that you provide to the Company in any form. By providing third-party information, you represent and warrant that you have the authority to do so and permit the Company to use such data in accordance with this Privacy Policy. Furthermore, you are responsible for informing these individuals of this Privacy Policy and/or obtaining their necessary consent.
Sensitive Personal Data: such as race as appeared in identification documents, religion as specified on national ID cards, labor union information, and biometric data (e.g., fingerprints, facial recognition, or iris recognition). It also includes health data, physical or mental conditions, criminal records, or any other data of a similar nature as prescribed by the Personal Data Protection Committee.
2.1 Directly from you: through the signing of contracts or the completion of forms; such as when you engage in business or transactions with the Company, or through interactions with the Company. This includes interactions via the Company’s online platforms, website, or mobile applications, as well as communications through email, telephone, surveys, business cards, postal mail, meetings, and various corporate activities.
2.2 From business partners: for whom you work, act on behalf of, or serve as an authorized representative.
2.3 From group companies, shareholders, or third parties: such as other business partners or representatives.
2.4 From electronic files and sources.
The Company shall collect, use, and/or disclose your personal data based on the nature of your relationship with the Company, for the purposes of our legitimate interests, contractual obligations, or other lawful bases. All processing of personal data shall be conducted in strict accordance with the Personal Data Protection Act (PDPA), relevant Ministerial Regulations, Notifications, and other applicable laws.
The Company shall not disclose your personal data to any third party, except for purposes essential to the Company’s business operations and provided that such disclosure does not violate the law. This may include sharing information with shareholders, other business partners, or third-party service providers engaged by the Company—such as cloud service providers, data analytics providers, and professional consultants (including lawyers, specialized technicians, and business support providers)—or for the purpose of exercising the Company’s legal rights.
In certain instances, the Company may be required to disclose your personal data to comply with laws or regulations. This includes disclosure to law enforcement agencies, courts, government authorities, or other third parties, if the Company believes such disclosure is necessary to fulfill legal or regulatory obligations. It may also be necessary to protect the Company’s rights, the rights of third parties, or individual safety; or to detect, prevent, or resolve issues related to fraud, security, or safety. Furthermore, in the event of a transfer of rights or similar transactions, whether in whole or in part, the Company may disclose your personal data to the Company’s assignees and/or successors. In an emergency, your personal data may also be disclosed to protect your vital interests.
5.1 The Company may send or transfer your personal data to affiliated companies or other third parties abroad where necessary for the performance of a contract to which you are a party, or for the fulfillment of a contract between the Company and another individual or entity for your benefit. This also applies to actions taken at your request prior to entering into a contract, or where necessary to prevent or suppress a danger to your life, body, or health, or that of another person. Furthermore, such transfers may be conducted to comply with the law or as necessary for the performance of tasks for significant public interest.
5.2 The Company may store your information on computer servers or cloud systems provided by third parties and may utilize third-party programs or applications in the form of Software as a Service (SaaS) or Platform as a Service (PaaS) to process your personal data. However, the Company shall not permit unauthorized persons to access your personal data and will require such third parties to implement appropriate security measures.
5.3 In the event that your personal data is transferred abroad, we will comply with personal data protection laws and implement appropriate measures to ensure that your personal data is protected and that you can exercise your legal rights regarding your data. This includes requiring recipients to have adequate data protection measures in place, process data only as necessary, and take steps to prevent unauthorized use or disclosure of your personal data.
The Company shall retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, disclosed, and used, unless such data collection falls under the exemptions prescribed by the Personal Data Protection Act B.E. 2562 (2019) or other applicable laws. Furthermore, the Company may be required to retain your personal data for a period exceeding that mandated by law, should it be necessary for legal or operational requirements.
Subject to the conditions prescribed by law, your rights are as follows:
7.1 Right of Access: The right to access and request a copy of your personal data, or to request the disclosure of how your personal data was obtained without your consent.
7.2 Right to Rectification: The right to request that your personal data be corrected, updated, completed, and not misleading.
7.3 Right to Erasure or Destruction: The right to request the deletion or destruction of your personal data, or to render it unidentifiable to the data subject.
7.4 Right to Data Portability: The right to receive your personal data in a format that is generally readable or usable by automatic tools or devices, and to send or transfer such data to another organization, provided that the personal data:
(a) Was provided by you to the Company; and
(b) Is processed based on your consent for collection, use, or disclosure, or for the performance of a contract between the Company and you.
7.5 Right to Object or Restrict Processing: The right to object to the Company’s collection, use, or disclosure of your personal data, or to request the restriction of its use.
7.6 Right to Withdraw Consent: The right to withdraw your consent for the collection, use, or disclosure of your personal data—where such processing is based on consent—at any time.
7.7 Right to Lodge a Complaint: The right to file a complaint with the competent authorities if you believe that the collection, use, or disclosure of your personal data is unlawful or inconsistent with applicable data protection laws.
Should you wish to exercise any of the aforementioned rights, please contact the Company via the “Company Contact Information” provided below. The Company will consider your request and notify you of the outcome within 30 days from the date of receipt. Please note that the Company may decline your request as permitted by law. However, the exercise of your rights shall not affect the collection, use, or disclosure of personal data previously provided to the Company. In the event that any damages arise from such data, you shall be solely and entirely responsible.
The Company has implemented appropriate personal data security measures, encompassing administrative, technical, and physical safeguards regarding access and access control. These measures are designed to prevent the loss, unauthorized access, use, alteration, modification, or disclosure of personal data.
Furthermore, the Company has established control measures and access restrictions for personal data, as well as for the secure use of data storage and processing equipment. We have defined specific rights and responsibilities for authorized users and restricted the access of others to prevent unauthorized access, disclosure, exposure, illicit copying, or theft of data storage and processing devices. Additionally, the Company maintains measures for regular auditing of the access, alteration, erasure, or transfer of personal data.
In the event of a personal data breach or suspected data leakage, the Company has established management procedures to ensure security and mitigate impact on data subjects as follows:
Upon detection or notification of a personal data breach, the Company will immediately conduct an initial investigation and assessment to identify the categories of affected data and the scope of the breach.
(a) In cases of no risk: If the Company assesses that the breach poses no risk to the rights and freedoms of individuals, the Company will document the details of the incident and the relevant measures taken in writing. This record will serve as evidence and reference for future audits by the Company or regulatory authorities.
(b) In cases of risk: The Company will notify the Office of the Personal Data Protection Commission (PDPC) of the breach without undue delay, and where feasible, within 72 hours of becoming aware of the incident.
(c) In cases of high risk: If the breach poses a high risk to the rights and freedoms of data subjects, the Company will notify the Office of the Personal Data Protection Commission (PDPC) within 72 hours. Additionally, the Company will notify the affected data subjects of the breach and provide remedial measures as soon as possible.
Any individual who observes or believes that a violation of this Privacy Policy and its Guidelines has occurred may report the incident or lodge a complaint. The procedures for such reporting shall be conducted in accordance with the Company’s Whistleblowing Policy and Guidelines. The Company guarantees that whistleblowers or complainants will be protected and all information provided will be kept strictly confidential. Furthermore, such reporting will have no adverse effect on the individual’s employment status, both during the investigation and after the process has been concluded.
The Company may amend or revise this Privacy Policy from time to time to ensure compliance with changes in legislation, technological advancements, or any other necessary and appropriate reasons. The Company will publish the revised Privacy Policy on its website at: https://nep.co.th/th/corporate-governance-th/privacy-policy-th/ prior to such changes becoming effective.
The Company operates in full compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and has appointed a Data Protection Officer (DPO) to oversee and monitor the Company’s operations concerning the collection, use, and disclosure of personal data. The DPO ensures that all such activities are strictly aligned with the PDPA and other relevant data protection laws and regulations.
If you have any questions or require further details regarding the protection of your personal data, please contact the Company through the following channels:
- Entity: NEP Realty and Industry Public Company Limited
Head Office: 41 Soi Phaholyothin 5, Phaholyothin Road
Phaya Thai District, Bangkok 10400, Thailand
Nakhon Ratchasima Office: Navanakorn Industrial Estate (Nakhon Ratchasima)
999/5 Moo 1, Mittraphap Road, Na Klang Sub-district
Sung Noen District, Nakhon Ratchasima 30380, Thailand.
- Data Protection Officer (DPO): > Privacy Center: 044-335520 ext. 117, 312, 127
Email : [email protected]
The Company shall conduct an annual review of this Privacy Policy to ensure its continued relevance and compliance.
This Policy shall become effective as of March 19, 2026.
Mr. SOONTORN POJTHANAMAS
Chairman of the Board
NEP REALTY AND INDUSTRY PUBLIC COMPANY LIMITED
