Gulf - Employee Privacy Notice

Last modified: 29 May, 2020

Maintaining the security and privacy of Personal Data (as defined below) is important to the way in which Gulf Energy Development Public Company Limited and our affiliated companies (hereinafter “Gulf”, “we”, “us”, or “our” ) operates business globally.

A. How this Notice applies

This Privacy Notice (“Notice”) explains the collection, use, disclosure and transfer of Personal Data (as defined below) and the data protection rights of individuals, including our current and former employees, retirees, current and former workers, job applicants, candidates, interns and/or any other considerations in each specific context context (hereinafter “you” or “your”) in the course of an existing or potential employment or work relationship with you. However, this Notice does not form part of your employment or work contract.


We need to collect, use, disclose and/or transfer your Personal Data (as defined below) in order to enter into employment/work contract with you, to continue performing crucial aspects of such contract, such as paying you and providing you with benefits, and to meet our legal or regulatory obligations. Certain Personal Data (as defined below) you share with us is necessary to enable us to perform or continue to perform our obligations under employment/work contract or carry out activities for the purposes set out in this Notice.

B. Changes of this Notice

This Notice may be amended or updated from time to time upon developments in our practices or policies with respect to the collection, use, disclosure and/or transfer of Personal Data (as defined below), or to reflect changes in applicable laws. It is suggested that you check back periodically to view any changes or updates to this Notice. The amendments to this Notice will be effective upon being published on our websites at [ https://www.gulf.co.th/en/privacy_notice ]. If such amendment or update, however, materially affects you as a data subject, we will give you a reasonable prior notice in a suitable manner before such amendment or update is effective.

C. How we collect, use, disclose and/or transfer and protect your Personal Data

1. Personal Data We Collect

1.1 Categories of Personal Data

“Personal Data” means any identified or identifiable information about you as listed below. If it is possible to combine any information with your Personal Data, or if other information is used to build a profile of an individual, we will treat such other information and combined information as Personal Data.


The specific types of data collected depend on the communication and interaction between you and us, your field of work or benefits received from us, including but not limited to:

Personal details: Personal details about you, such as title, first name, last name, copies or information on government-issued cards (e.g., national identification number, tax identification number, passport number and household registration information), signatures, images, work-related information (e.g., your position, function, occupation, job title, company you work for, employment status, or shareholding status), and other identifiers.
Contact details: Your contact details, such as address in the household registration, current/home address, personal e-mail address, work e-mail address, work phone number, mobile phone number, and other similar contact information;
Educational details: Your educational history, such as degree, major, grade, education level, educational institution, field of education, country of education, start and end date;
Work experience details: Your employment background, such as occupation, company name, present employer position, employment/work time period, starting salary, latest salary, salary currency, country, start date, end date, job description, and reason for leaving;
Employment or work related details: Information relating to your employment or work, such as employee ID, user login and password, working history, country of overseas secondment assignment, period of overseas secondment assignment, performance evaluation history, training history, disciplinary action history, competency details, working hour details, leave information, overtime information, position, type of employment/work, employment/work terms and condition, period of contract, department, workplace;
Financial, salary and benefits details: Information relating to your salary and benefits, such as your salary expectation, details on salary, wages and allowances, payroll information, salary history, bank account details (e.g., bank country, bank name, and bank account number), tax payer identification number, tax deduction information, social security, credit report and provident fund information;
Interest and abilities: Information about your interest and abilities, such as language skills (speaking, reading and writing proficiency level), professional certificate details (e.g., type, name issued, and expiry date), hobbies, motto, and food preference;
Views and opinions: Information about your view and opinion such as, your preference about our contract to employment/ work relationship or other information that you choose to send to us, comments, feedbacks, complains, recommendations, survey responses, inquiries and any information you volunteer during human resources related communications;
Other details: Information other than specified above, such as type of internet reference, ability or willingness to work up-county, dismissal from employment; and
Sensitive Data: 1. Religion data: As provided by you in the application form and shown on your national identification card;
2. Health data: From the employee health examination information, and company welfare withdrawal information
3. Biometric data: Your fingerprint; and
4. Criminal records: As part of background checking.
Personal Data of third parties

If you provide us with Personal Data about other persons such as, personal information of contact person, board members, directors, shareholders, representatives, or other persons who have executive power in your organization, or you ask us to disclose their Personal Data to third parties, you are responsible for notifying those other persons of the details of this Notice, including obtaining any required consent from such third parties (where consent is required). You must also ensure that we can lawfully collect, use, or disclose those persons' Personal Data as set out in this Notice.

Personal Data of minors, incompetent persons and quasi-incompetent persons

Our employment or work activities do not aim at collection, use, disclosure and/or transfer of minors’, incompetent persons’ and quasi-incompetent persons' Personal Data in the employment/contract context. However, in the event where we collect such Personal data, we will only collect such Personal Data of minors, quasi-incompetent persons, and incompetent persons where their parents or guardians have given their consent, or where we can rely on other legal basis as permitted by laws. We do not knowingly collect Personal Data from individuals under the age of 20 without their parental consent when it is required, or from quasi-incompetent persons and incompetent persons without their legal guardian's consent. Upon being aware of unintentional collection of Personal Data from anyone under the age of 20 without parental consent when it is required, or from quasi-incompetent persons and incompetent persons without their legal guardians consent, we will delete it immediately or collect, use, disclose and/or transfer only if we can rely on other legal bases apart from consent.

1.2 Collection of your Personal Data

We may collect your Personal Data through various means, such as directly from you (e.g., from application forms, documents provided to us, the interview process, interactions at job event or fair, via our website, via email, or communications between us) or indirectly from other sources (e.g., from a recruitment agencies, from Gulf group companies and affiliates or other third parties, and through publicly available sources) For reasons of office, site and facility security and safety, we use video surveillance (CCTV) in our offices, sites and facilities. Please refer to our Privacy Notice on CCTV use accessible at https://www.gulf.co.th/

2. On what basis and why we collect, use, or disclose your Personal Data

Except in limited instances when we indicate that collection, use, disclosure and/or transfer are based on your consent, we generally use the following legal justifications: (1) a contractual basis, for our initiation or fulfilment of a contract with you; (2) compliance with legal obligations; (3) the legitimate interest of ourselves and third parties, to be balanced with your own interest and fundamental rights and freedoms in relation to the protection of your Personal Data; and (4) vital interest, for preventing or suppressing a danger to a person’s life, body or health.

Relying on the legal bases set out above, we may collect, use, disclose and/or transfer across borders of your Personal Data collected for various purposes, depending on how you interact with us as a former and current employee, retiree, former and current worker, job applicant, candidate, and intern, and/or any other considerations in each specific context. All the purposes as listed below set out the general framework of our data usage practices and only the relevant purposes will be applicable to you.

2.1 The purposes for which we collect your Personal Data

If you are a job applicant or candidate, we rely on the legal bases above for the following purposes of collection, use, disclosure and/or transfer across borders of your Personal Data:

Recruitment: To manage recruitment, to consider applications for placement/employment, including internship processes, to make job offers, to manage work placement, to assess candidates for upcoming job opportunities, to authenticate and verify the applicant or candidate's identity, to contact and communicate with the applicant or candidate in recruitment process, to execute employment/work agreement;
Background check: To perform background and employment history check and make a hiring decision, and whether you are offered a position with us; and
Emergency contact: To communicate with your designated contacts in case of an emergency

If you are our employees, workers, retirees, and interns, depending on the context of our relationship with you, we rely on the legal bases above for the following purposes of collection, use, disclosure and/or transfer across borders of your Personal Data:

Employment/work relationship: To administer recruitment process, including intern recruitment, to enter into contract and manage our employment/work relationship with you, to perform background and employment history check, to carry out orientation, payroll and welfare preparation, to issue name badge and staff identification pass; to issue employee parking ticket/card; to provide tools and/or equipment in order to carry on employed tasks, to administer our relations with you, to fulfil our obligations as an employer, to evaluate work performance and career advancement, to inspect office, sites and facilities, to maintain employee records, to maintain work attendance and leave records (e.g. sick leave, business leave or maternity leave), to arrange for the overseas secondment assignment, to assist employees in visa and work permits process, to transfer to new position in our affiliates, process on off-boarding, to process post-employment services, certifications, cessation/termination of employment/work contract, exit interviews and ad hoc surveys and make severance payment;
Communication and emergencies: To communicate with you in relation to business/work, to contact you or your emergency contact in emergency situation to prevent or suppress a danger to a person’s life, body, or health;
Payment, compensation and benefits provision: To process payment and advance payment, to administer salary and wage payment and review, to prepare tax filing and report, to determine and oversee benefits including insurance, provident fund, actuarial valuation social security, mortgage and loan support, to process application of health insurance for spouse and children, and to supplement the reimbursement of family welfare benefits;
Data analytics and survey: To process human resource data for outsourced payroll data analytics, for assessment of demographic manpower, increase, annual assessment, development and training, to conduct total remuneration survey, engagement survey, and data analytics;
Business operational purposes: To manage workforce, to oversee employment engagement and talent management program, to provide system access and email communication, to assess company resources for job operation, to allocate resources, to administer and manage training, to manage work where employees take leave, to process disciplinary and complaint proceeding (including internal investigation), to evaluate International Position (OD Project), and to allow for external audit;
Protection of our interests: To manage workforce, to oversee employment engagement and talent management program, to provide system access and email communication, to assess company resources for job operation, to allocate resources, to administer and manage training, to manage work where employees take leave, to process disciplinary and complaint proceeding (including internal investigation), to evaluate International Position (OD Project), and to allow for external audit; To oversee, safeguard, and inspect risk exposure, to prevent fraud, claims and further liabilities, to encompass but not restricted to violations of company contract terms, regulations, or laws, to perform institutional risk control, to protect the security and integrity of our business, to exercise our rights or protect our interests where it is necessary and lawfully to do so (e.g., to determine fraud risk and identify fraudulent transactions, intellectual property infringement claims, or violations of law), to manage and prevent loss of our assets and property, to perform internal audits and records, asset management, system, and other business controls, to maintain data accuracy, to keep business records and otherwise to operate, manage, and maintain our business operations, to maintain internal business management for internal compliance requirements, policies, and procedures, to prevent or suppress a danger to a person’s life, body, or health, to secure the compliance of our contract terms, to follow up on incidents, to prevent and report criminal offences, for reference and evidence related to claims or litigation;
Security and System Monitoring: To safeguard the confidentiality, security, and accessibility of our sites, IT systems, networks and hardware, and information, to provide IT and helpdesk supports, to create and maintain code and profile, to manage the access to any systems to which we have granted the access, to remove inactive accounts, to implement business controls to enable our business to operate, to enable us to identify and resolve issues in our IT systems, to keep our systems secure, to perform IT systems development, implementation, operation and maintenance, to authenticate and access controls and logs where applicable, to monitor of system, devices and internet;
Carrying out legal obligations and compliance: To comply with appropriate rules, regulations, and laws (including tax report and tax filing), and in advancement of our associated internal policies, counting records retention requirements and compliance policies, to exercise our rights or defend against legal claims, to maintain record keeping and resolving complaints and disputes, to comply with legal obligations, legal proceedings, or government authorities' orders which may include orders from government authorities outside Thailand, and/or cooperate with court, regulators, government authorities, and law enforcement bodies when we reasonably believe that we are legally required to do so, and when disclosing your Personal Data is strictly necessary to comply with the said legal obligations, proceedings, government orders, codes of conduct and our internal policies, to perform compliance activities, to conduct internal and regulatory reporting; and
Corporate Transactions: To disclose and transfer your Personal Data to third parties as part of business transaction, for example sale, transfer, merger, reorganization, or similar event.

2.2 Sensitive Data

We will only collect, use, or disclose sensitive data on the basis of your explicit consent, for establishment, defence, compliance or exercise of legal claims, for satisfying legal obligations in relation to substantial public interest or where otherwise as permitted by law. Where consent is required, we will separately ask for your consent via the appropriate methods.

Religion data: For the support on food restriction and activities.
Health data: For recruitment consideration and hiring process, for conduct annual health check, for tracking of preventive surveillance of employees' health and analytical report.
Biometric data (i.e., fingerprint): For time attendance and building access administration.
Criminal records: For recruitment consideration, and background screening/ check, For record keeping with employment documents, For evidence of non-employment record, and for running check with others where applicable.

3. Disclosure of Personal Data

Depending on the context of your relationship with us and the nature of products or services you obtain from us, we may disclose your Personal Data to the following parties for the purposes as described in this Notice:

Gulf group and affiliates: Gulf is a multinational corporation. We distribute information, including Personal Data, internally among our corporate affiliates in the typical course of our day-to-day transactions. For a current listing of our power plants and other projects, please visit our website at: https://www.gulf.co.th/en/business_overview
Service providers or suppliers: We may disclose your Personal Data to service providers or suppliers (or they may gather Personal Data precisely on our behalf), as engaged to provide services or support for various business purposes, for example, outsourcing payroll and benefit providers, human resources, performance management, and training services providers, IT service provider including, database, data storage cloud service, software, and network providers, human resource consulting, management consulting, engagement survey, background checking providers, payment service providers, payment networking service providers, administrative and business support service providers, document storage and destruction service providers, data backup service providers, printing service providers.

Our service providers may process Personal Data in compliance with our mandates and is subject to applicable legal, confidentiality and security requirements.
Business partners: We may disclose your Personal Data to companies that we have partnered with to offer or enhance our products or services, such as state enterprises, and financial institutions, to perform our products or services.
Professional advisors: We may disclose your Personal Data to professional advisors such as auditors, legal advisors or counsels, accountants, and tax consultants who assist us in running our business and defending or bringing any legal claims, initiating and managing auction or otherwise taking legal actions.
Third parties with whom you authorize or direct us to share your Personal Data We may disclose your Personal Data with your consent or at your direction.
Third Parties as assignees, transferees, or novatees: We may assign, transfer, or novate our rights or obligations to a third party, to the extent permitted under an agreement between us and you. We may disclose or transfer your Personal Data to assignees, transferees, or novatees, including prospective assignees, transferees, or novatees, provided that we will use our best efforts to ensure that these data recipients agree to treat your Personal Data in a manner consistent with this Notice.
Third parties connected with corporate transactions: We may disclose or transfer your Personal Data to third parties that are connected with possible or substantive sale of our business or any of our assets, or those of any related company, particularly through acquirements or mergers, alteration in divestitures or control, or affiliation with bankruptcy. In such instances, Personal Data collected by us may be one of the reassigned equities.
Government entities and others with whom we disclose Personal Data for legal or necessary purposes We may disclose your Personal Data to government entities or regulatory bodies and others for legal, regulatory and other necessary purposes. This includes responding to requests from regulators or government authorities for purposes of law enforcement, legal orders, audits, or legal processes/claims.
Other third parties: We may disclose your Personal Data to persons involved in the provision of the type of products or services offered by us including your corporate insurer, your contact persons and/or your employers. If you attend our events, we may distribute your name in the participant list and/or promotional materials. We may incorporate videos, photographs, and additional multimedia taken of the individual on our website and in certified report materials.

4. Transfer of Personal Data to other countries

We may disclose or transfer your Personal Data to our affiliates, third parties or servers located outside Thailand for lawful purposes. Some recipients of your Personal Data are located in another country for which the Personal Data Protection Committee under the Thai Personal Data Protection Act B.E. 2562 has not ruled that this country has adequate data protection standard.

5. Retention of your Personal Data

We will store your Personal Data for as long as it is necessary for the purposes for which it was collected, as explained in this Notice and in accordance with the applicable laws. However, we may retain your Personal Data for a longer period in order to comply with applicable laws and regulations and our internal policy or with regard to our operational requirements, such as proper record maintenance, facilitating relationship management, and responding to legal claims or regulatory request.

6. Your Personal Data Protection Rights

The rights in this section are your legal rights, where you may request exercise of these rights under the conditions prescribed by law and our right management procedures. These rights are as follows:

a) Right to Access: You have the right to access and request a copy of Personal Data concerning you, or request us of the disclosure of the acquisition of your Personal Data acquired without your consent;
b) Right to Rectification: You may have the right to have incomplete, inaccurate, misleading, or not up-to-date Personal Data collected about you rectified;
c) Right to Objection: You have the right to object to the collection, use, or disclosure of your Personal Data, on grounds relating to your particular situation;
d) Right to Erasure: You have the right to request us to delete, destruct or anonymize your Personal Data to the extent permitted by laws;
e) Data portability: Where legally applicable, you have the right to request your Personal Data in a structured, commonly used and machine-readable format, and transmit it to another organization;
f) Right to Restriction: You have the right to request us to restrict the use of your Personal Data;
g) Right to Consent withdrawal: Where you have given your consent for the collection, use, or disclosure of your Personal Data, you have the right to withdraw your consent at any time; and
h) Right to Lodge a Complaint: You have the right to file a complaint with the competent authority regarding the collection, use, and/or disclosure of your Personal Data by us or on our behalf. We would, however, appreciate the chance to deal with your concerns before you approach the competent authority, so please contact us in the first instance.

Your request for exercising any of the above personal data protection rights may be limited by the applicable laws. There may be certain cases where we can reasonably and lawfully decline your request, for example, due to our legal obligation or court order.

7 . Our Contact Details

If you have any inquiries or concerns in connection with this Notice or the collection, use, or disclosure of your Personal Data by us, or you would like to submit a request to exercise your rights, please contact us at:


Gulf Energy Development Public Company Limited
87 M. Thai Tower 11th Floor, All Seasons Place, Wireless Road,
Lumpini, Pathumwan, Bangkok 10330
Tel: +662-080-4499
Fax: +662-080-4455
E-mail: contact@gulf.co.th