PRIVACY NOTICE FOR CCTV USE

1. About Us

We, Samitivej Public Company Limited, Address 133 Sukhumvit 49, Klongtan Nua, Vadhana, Bangkok 10110, Website : 

https://samitivej-jp.com/, a medical facility/ hospital as a Data Controller persuant to the Personal Data Protection Act B.E. 2562, provide this notice to inform you regarding information on our collection, use, and disclosure of your personal data that we collected and about your rights.

2. How We Process Your Personal Data

We use CCTV collect, use, disclose, or process your personal data for the following purposes:

  (a) to protect individuals’ life, body, health and well-being, personal safety, and belongings; 

  (b) to protect and prevent our premises, facilities and assets from damage, disruption, vandalism, and other crimes; 

  (c) to support law enforcement agencies in the prevention, detection, and prosecution of crimes and to act as a deterrent against crimes; 

  (d) to assist in the effective resolution of disputes which arise in the course of disciplinary or grievance proceedings; 

  (e) to assist in the investigation or proceedings concerning a whistleblowing complaint; and loment proceedings 

3. Legal Bases

We may collect, use, disclose, or process your personal data base on any of the following legal basis: 

  (a) Vital Interest. The collection, use, disclosure, or processing is necessary for the prevention or suppression of a danger to a person's life, body, or health. 
  (b) Legitimate Interest. It is in our legitimate interest to collect, use, disclose, or process, your personal data to achieve any of the purposes described above. 
  (c) Legal Obligations. We owe a duty to comply with the legal obligations prescribed by the applicable laws, including but not limited to the laws regarding safety and environment in the workplace. We consider the use of CCTV as a necessary measure to enable us to meet those obligations.

 
4. CCTV Installation

• There are  566 CCTV cameras on our premises. 
• We place appropriate signage in the monitored areas to alert you that a CCTV operation is in use and your personal data is recorded. 

5. Period of Personal Data Retention

• We may retain your personal data no longer than 30 days or as is necessary to achieve the purposes described in this notice or as is required by applicable laws. We may need to retain your personal data for so long as it is necessary for any disputes or legal proceedings that may arise. 
• Our CCTV will record movement of all person within the proximity to the CCTV cameras in our premises at all times (24 hours). 
• If we no longer need to retain your personal data, we may destroy, delete, remove or anonymize your personal data. 

6. Safety Measures

The Company will manage the retention of personal data with organizational and technical measures not less than the level required by law and with appropriate system to protect and secure your personal data.  This includes storing your personal data in a secured facility with authorized personnel access only. 

The following steps are required in case when authorized personnel or other agencies’ personnel request access to inspect or access to information from the CCTV footage: 

• Fill out the form requesting data/information from the CCTV. 
• Submit the request form to Security Supervisor for appropriate procedures for approval. 
• Security Officers from the CCTV Control Room receive the request to access or inspect information from the CCTV. 
• In the case the permission is authorized, there must be a Security Supervisor and a Security Officer present in the CCTV Control Room along with the authorized personnels or other agencies’ personnels while such personnels view data/information from the CCTV footage. 
• A log of personnels who access and view CCTV footage must be kept along with conclusion/findings from viewing the CCTV. This log must be provided to the Manager in -charge of Security for acknowledgement and record keeping. 
• In the event of a request for information from the police, an approval from Managing Director (or equivalent) is required. 

7. Disclosure of your Personal Data to Third Parties

• We may share information from CCTV footage with government officials, for example upon written request from government officials or such request is for the investigative process of government officials or for litigation in court proceedings. 
• We may allow the CCTV Vendor to access our CCTV system for maintenance purpose whereby explicit authorization from us is required. The vendor must access the system and CCTV with appropriate security measures and on confidential basis. 

8. Your Rights

You have the following rights pursuant to the laws: 

(a) Right of Access. You have the right to access and obtain a copy of your personal data or request to disclose your personal data. The request must be in writing and sent to the channel provided in the "CONTACT US" section. Your request will be processed within the period required by law. We may, to the extent permitted by law or a court order, refuse to act on your request where such request could affect the rights and freedom of another person. 

(b) Right to Rectification. You have the right to have incomplete, inaccurate, misleading, or not up-to-date personal data that we process about you rectified. 

(c) Right to Data Portability. You may have the right to obtain your personal data we hold, in a structured, electronic format, and transmit such data to another data controller, where this is (1) personal information which you have provided to us, and (2) if we are processing that data on the basis of your consent. 

(d) Right to Object. You have the right to object to the collection, use, or disclosure of your personal data for the purposes of achieving our legitimate interest (or that of other persons). We may refuse to comply with your request if we can demonstrate compelling legitimate grounds for such collection, use, or disclosure, which may override your own interests or if such collection, use, or disclosure is for the purposes of establishment, compliance, exercise or defense of legal claims. 

(e) Right of Erasure. You have the right to request us to erase or destroy your personal data or to anonymize your personal data if you believe that (1) the personal data is no longer needed for the purposes described in this notice or (2) the collection, use, or disclosure of your personal data is unlawful. We may refuse to comply with your request for erasure or destroy for the purposes of establishment, compliance, exercise or defense of legal claims, or compliance with laws. 

(f) Right to Restriction of Processing. You have the right to request us to suspend the use of your personal data if you believe that we no longer need to retain the personal data for the purposes described in this notice, but you still require the retention for the purposes of establishment, compliance, exercise or defense of legal claims, or compliance with laws. 

(g) Right to Withdraw Consent. If you have consented to our collection, use, or disclosure of your personal data, you have the right to withdraw that consent at any time. 

9. Contact Us

You can contact our Data Protection Officer (DPO) to exercise your rights or for any inquiries related to this notice at email  : info@samitivej.co.th, Address : 133 Sukhumvit 49, Klongtan Nua, Vadhana, Bangkok 10110, Tel.  +66 2022 2222