Employee Policy

Employees’ Personal Data Policy The Board of Directors of Jubilee Enterprise Public Company Limited (“the Company”) as an employer responsible for managing labor protection and welfare for the Company’s employees has the intention to issue this Company Announcement on Employees’ Personal Data Policy to inform all employees of their rights and conditions related to the collection, use, and disclosure of employees’ personal data that the Company operates as detailed below. Under this Announcement, employees mean directors, executives, employees, and employees under employment contracts (all types of employees are collectively referred to as “Employees” ).

Section 1 Name of the announcement and its enforcement

1.1 This announcement is called the “Company Announcement on Employee Personal Data Policy” and shall be effective from the date of announcement by the Company onwards. This announcement shall be effective for all employees of the Company.

1.2 The Company may revise this Announcement from time to time to comply with relevant practices and laws, including changes in employment patterns or the provision of labor protection or welfare to employees. The Company will notify employees of the changes, and such announcement shall be deemed effective immediately upon posting.

Section 2 Definition of Personal Data “Personal Data” means data that enables the identification of an individual employee, whether it is data that the Company (a) receives directly from the employee, (b) receives from external labor protection and welfare service providers that the Company hires to provide labor protection to employees, or (c) receives from the collection, evaluation and preparation of additional such data by the Company itself as an employer during the employment period under the terms and conditions set by the Company.

Section 3 Personal data of employees that the company needs to process includes:

3.1 Information that directly identifies the employee, such as name, surname, ID card or passport number and copy, age, nationality, date of birth, including history showing other qualifications related to the employee, which the employee has provided to the Company in the recruitment form, employment contract and other forms, including information in the Exit Interview.

3.2 Employee contact information, such as address on ID card, current address, telephone number, email or other communication channels.

3.3 Payment information that the company processes for employees, such as bank accounts, payment history, including salary, social security number, details of various welfare insurances, including details of provident funds or other funds, and details of the use of various welfare rights of such employees.

3.4 Work history information includes but is not limited to entry-exit information, working hours, leave history, evaluation information of employee work qualifications and training, which is recorded by work recording systems in various forms and from ability assessments and measurements conducted by the Company, including history of use of the Company's system, including Username / Password and all log-in details to access the Company's system.

3.5 In case of receiving the employees' express consent, it may include other sensitive personal data such as health information (including medical certificates, treatment and vaccination, chronic diseases, etc.) which is necessary for providing welfare and overall labor protection of the company.

3.6 Photographic data, both still and moving images, of employees participating in various activities organized by the company, both activities to promote relationships within the organization and activities to communicate with external parties.

3.7 Information on name, surname, signature and other transaction details that the Company may prepare, collect in connection with signing and preparing various documents related to the Company's business operations.

3.8 Other personal data that employees may provide to the Company for evaluation, analysis, management and provision of additional benefits that the Company may provide to employees, such as feedback forms, activity participation forms, etc.

Article 4 Purpose of processing personal data under the framework

(1) Performing duties in accordance with the law for labor protection and others.

(2) The employer's performance of duties under the employment contract, including:

(3) Protection and defense of the Company's legitimate interests. The Company's main objectives in processing the personal data of the employees are as follows:

4.1 In order to perform the Company's duties under the law, the Company needs to process the personal data of its employees for specific purposes, including facilitating and/or supervising the calculation of tax payments and withholding tax, preparing employee registers, providing social security, providing provident funds, training and developing labor skills, protecting and caring for labor health, controlling communicable diseases, and may include immigration and/or obtaining work permits/work permits (in the case of foreign employees) as prescribed by relevant laws.

4.2 For the exercise of the Company's rights and duties as an employer under the employment contract , which may include the supervision and management of the employment relationship between employees and the Company, which may include but is not limited to the processing of personal data for the following purposes: Execution of the Company's and employees' rights and duties under the employment contract, including the provision of welfare and various labor protections, and the use of employees' data to perform work as instructed on behalf of the Company; Management of salary payments, performance evaluations, monitoring and/or management of employees' performance; setting performance targets; managing and/or recording employees' achievements or progress; considering employees' suitability for promotion; granting awards or other benefits that the Company may provide, including considering the design of training programs (whether organized by the Company or other persons) or using them to enforce disciplinary measures against employees who may not comply with or violate employment duties specified in the employment contract or other labor announcements, which is considered the exercise of the Company's rights as an employer under the employment contract; managing and/or administering employment benefits and welfare; managing rights verification and identity confirmation to provide benefits under the employment contract to employees in various parts, such as insurance rights and/or claims; managing health checks in accordance with the conditions provided by the Company; communicating and coordinating with employees for the purpose of supervision and/or management of Employment relationship between employees and the company or emergency contact

4.3 For the legitimate interests of the Company, especially for internal risk management, the exercise of the Company's legitimate rights, which may include but are not limited to the processing of personal data for the following purposes: Company operations, for the execution of legal proceedings, for the acquisition of legal rights and remedies, for the defense of lawsuits or court claims, and for the management of any complaints or claims between the Company and its employees, for the collection and preparation of statistics, internal research and/or reporting, and/or the collection of various data for the purposes of reporting of the Company and/or its affiliates, including research, analysis and development (including but not limited to surveys, questionnaires and/or collection of useful data), for the development of the Company's infrastructure, welfare, benefits and facilities, including the operation to develop the Company's products or services, including to promote the employment relationship between employees and the Company or for other benefits of employees, for the preparation of the Company's public relations media, which may disclose and present personal data of employees, which may include but are not limited to photographs or information on the expertise and qualifications of employees, whereby such public relations media data will be used, disclosed, processed and disseminated by the Company both electronically and in paper form, for the management of risk management, for the prevention of conflicts of interest, for the control and supervision of the Company's internal operations through various processes, including the examination of the employment history of such employees in the future when such employees may return to apply for jobs at the Company again. Collecting information for consideration of employee history in case the employee re-applies for a new job.

4.4 In the event that an employee specifically gives consent, the Company may process the employee's personal data for the specific purposes for which the employee has given consent.

Article 5 Period of retention of personal data

5.1 The Company is required to collect and maintain the personal data of its employees throughout the duration of each employee's employment contract and for the necessary period for which the Company is required to keep it in accordance with the time frame stipulated in the relevant laws.

5.2 For the benefit of protecting and defending against legitimate claims between the Company and employees under the employment contract and labor protection law, by ensuring that the rights of the data owner are not affected unduly and under the conditions of exercising the data owner's rights to object to data processing in accordance with the law, the Company reserves the right to retain the personal data of employees for an appropriate period of time according to the statute of limitations of 10 years after the expiration of the duties under the employment contract.

5.3 In the case of using advertising media images, including compiling statistics (including compiling employee registers) and reporting documents that employees have performed in the course of their employment with the Company, the Company reserves the right to keep the employees' personal data for as long as the Company may have a business need to perform such actions.

Article 6 Disclosure of Personal Data For the benefit of labor protection and labor welfare provision as specified in the employment contract and under relevant laws, the Company may be required to disclose personal data of employees to external parties for one or more of the purposes as specified. Persons to whom personal data will be disclosed include:

6.1 (a) The Company's business partners; (b) The Company's external service providers who provide various welfare-related services to employees on behalf of and for the Company, including but not limited to payroll service providers, group insurance service providers, human resource management (HRM) or personnel development (HRD) service providers, insurance companies, information technology service providers or other support service providers, etc., including (c) consultants or service providers in the Company's business operations. Such disclosure of personal data shall be carried out only to the extent necessary under the personal data processing contract to be signed between the Company and the person to whom such personal data has been disclosed.

6.2 Government agencies, including but not limited to the Revenue Department, Social Security Office, Department of Skill Development, Department of Employment, courts and other dispute resolution bodies, or other government agencies to which the Company may be subject by order, law or judgment to disclose employee information to such government agencies.

6.3 In the event of receiving the express consent of the employee, the Company may disclose personal data to other persons as specified by the employee and notified to the Company, which may include but is not limited to disclosing the employee's personal data to financial institutions or other reference contact persons, etc.

Article 7 Measures for the security of personal data

7.1 The Company guarantees to provide appropriate security measures to prevent unauthorized or improper access, use, alteration, modification or disclosure of personal data of employees. The Company will arrange for regular reviews of such security measures to ensure suitability according to relevant standards and laws.

7.2 In the event that any employee has the right to access or process any personal data, such employee accepts and acknowledges the duty to maintain the security of such data as well, by guaranteeing, compensating and indemnifying the Company in the event of any damage to the Company resulting from the failure of such employee to perform the duty to maintain the security of personal data.

Article 8 Rights of Employees as Data Owners The Company declares the legal rights of employees in relation to the personal data of such employees, which include:

8.1 The right to request access to and obtain a copy of personal data, including the right to request that personal data be corrected to be current and accurate.

8.2 The right to request personal data in the event that the Company makes such personal data in a format that is generally readable or usable by means of automated tools or devices, including the right to request that such data be sent or transferred to another personal data controller.

8.3 Right to object to the processing of personal data

8.4 The right to request that personal data be deleted, destroyed, or anonymized when such data is no longer necessary or when the owner of the personal data withdraws consent.

8.5 The right to request the suspension of the use of personal data in the event that personal data must be deleted or when such data is no longer necessary.

8.6 The right to withdraw consent to the processing of data that the employee has previously provided. The Company will consider and notify the result of consideration of the employee's request to exercise the rights within a reasonable period as prescribed by law. The employee can contact the Company according to the contact details specified by the Company at: Email DPO@jubileediamond.co.th or contact the head office of Jubilee Enterprise Public Company Limited, 179 Bangkok City Tower, 10th Floor, South Sathorn Road, Thung Maha Mek Subdistrict, Sathorn District, Bangkok 10120. In addition, you can contact the Company via Call Center at 02-625-1111, Monday - Friday, 9:00 a.m. - 6:00 p.m.

Last modified: May 26, 2022