Privacy Notice

The protection of your privacy in personal data processing is an important priority for robatherm (“we”, “our”, “us”), which we would like to take into consideration all of our business processes. We process your personal data exclusively in compliance with data protection regulations. In addition to general information (Part 1), this Privacy Notice also includes information concerning the processing of personal data in connection with the use of our website (Part 2), and with our online profiles in social media (Part 3), information concerning the processing of your personal data if you are our customer, an interested party (Part 4) or our supplier (Part 5), and information concerning the processing of your personal data as an applicant at our company (Part 6).

Part 1 – General information

1. Controller in terms of PDPA

robatherm Co., Ltd

123 Suntowers B, 28th Fl,
Vibhavadi-Rangsit Road, Jomphol, Jatujak,
Bangkok 10900
Thailand

and

Amata City Industrial Estate
7/208 Moo 6, Mab Yangporn
Pluakdaeng, Rayong 21140
Thailand

Telephone: +66 (0) 38 926 010

2. Right to information, rectification, erasure, restriction of processing, data transferability, objection, withdrawal, complaint

You are entitled
• to access information concerning your personal data processed by us;
• to immediately request completion or the rectification of incorrect of your personal data stored by us;
• to request erasure of your personal data stored by us;
• to request restricted processing of your personal data;
• to receive your personal data, which you provided to us, in a structured, commonly used, and machine-readable format or to request transmission to another controller;
• to object to the processing of your personal data;
• at any time to withdraw consent granted to us, with the consequence that our processing based on such consent will be prohibited for the future without affecting the lawfullness of any processing that occurred prior to your withdrawal of your consent;
• to lodge a complaint with a supervisory authority.

In the event that you have questions that are not answered in this privacy statement or if you would like to have more in-depth information for any matter in this regard, please contact us at any time through the contact information listed above.

3. No automated case-by-case decisions or profiling measures

We do not use purely automated processing operations to reach a decision.

4. Security

robatherm implements technical and organizational security measures to protect your personal data against accidental or unlawful deletion, modification, or loss, and against unauthorized forwarding or unauthorized access.

5. Status and modification of this privacy statement

This Privacy Notice was last updated in September 2020. It may become necessary to modify this privacy statement due to the continuous development of our website or modified statutory or official requirements. The respective current Privacy Notice is available under https://www.robatherm.com/th/privacy-notice.

Part 2 – Information for website users

6. Communication- or usage-oriented data

When accessing our website through telecommunication services, communication-oriented information (data (e.g. Internet protocol address, referrer, URL, browser) or usage-oriented data (e.g. information concerning start and duration of use and the telecommunication services used by you) are automatically generated by technical means. These generally do not allow us to determine the identity of the website user.
Such data is collected and used to ensure a seamless connectivity of the website and convenient use of our website. This information is furthermore used to evaluate system security and stability and for other administrative purposes. Such data is processed within the scope of our legitimate interests.
Such data will be erased if they are no longer required for the stated purposes.

7. Transfer of data to third parties

Our websites and the services offered thereon are supported by technical service providers on our behalf (e.g. hosting). Personal data collected through this website is generally not transmitted unless specified otherwise below.

8. Use of cookies

This website utilizes cookies. Cookies are text files which a website places on your hard drive. Cookies do not harm your computer and do not contain any viruses.

Information concerning the specific terminal device used by you is stored in a cookie. However, this does not allow us to gain direct knowledge of your identity.

We use cookies to make your use of our offer more convenient for you. We use so-called session cookies to recognize whether you have already visited individual pages of our website. They are deleted automatically after you leave our website.
We also use temporary cookies to optimize user-friendliness. They are stored on your terminal device for a specific duration. If you visit our website again, we can automatically recognize that you have previously visited us as well as your previous entries and settings, so that you do not have to enter these again.
We furthermore use cookies to collect statistical data concerning the use of our website and to optimize our offer. With each new visit, these cookies allow us to automatically recognize that you have already visited our site. These cookies are automatically deleted after a specific defined period.

If you have consented to the setting of cookies, your consent is the legal basis for the processing of the data. Concerning necessary cookies, the legal basis is PDPA (legitimate interests).
Data processed through such cookies is necessary for the stated purposes to safeguard our legitimate interests and third-party interests.
Information on which cookies are necessary can be found in the following overview.

You can deactivate the use of cookies at any time through your browser settings. Please use your Internet browser’s help functions to find out how to change these settings. A complete deactivation of cookies may, however, result in your inability to use all functions of our website.

9. Google Analytics

If you have given your consent, we use the service "Google Analytics" provided by Google LLC on our website. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter „Google“).

Scope of processing

Google Analytics uses cookies that enable an analysis of your use of our website. The information collected by means of the cookies about your use of this website is usually transferred to a Google server in the USA and stored there.

We use the function 'anonymizeIP' (so-called IP-Masking): Due to the activation of the IP anonymization on this website, your IP-address will be abbreviated by Google within the Member States of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.

During your website visit, the following data, among others, is collected:
• The pages you have visited on our website, i.e. your "click path”
• Achievement of "website goals" (conversions, e.g. newsletter registrations, downloads, purchases)
• Your user behavior (e.g. clicks, dwell time, bounce rates)
• Your approximate location (region)
• Your IP address (in abbreviated form)
• Technical information about your browser and the end devices you use (e.g. language settings, screen resolution)
• Your internet provider
• The referrer URL (via which website/advertising medium you came to this website)

Purpose of processing

Google uses this information on behalf of robatherm to evaluate your (pseudonymous) use of the website and to compile reports on website activities. The reports provided by Google Analytics serve to analyse the performance of our website and the success of our marketing campaigns.

Recipient

The recipient of the data we send and which is linked to cookies is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as processor on behalf of robatherm. We have entered into a data processing agreement with Google for this purpose.

The data stored by Google may also be accessed and processed by other Google group companies, including Google LLC, based in California, USA. The United States are a so-called third country, which does not guarantees for an adequate level of protection in accordance with the requirements of the GDPR based on an adequacy decision by the European Commission pursuant to Art. 45 GDPR. It can therefore not be ruled out that US authorities may have access to this data.

The data stored by Google may also be processed by Google group companies for own purposes, such as to provide Google's web analytics and tracking services, and may be linked to your Google account, search history and other data that Google has stored about you, such as your usage data from other devices. robatherm has no influence on this data processing, so that Google alone is responsible for this data processing. Further information on how Google processes your data can be found in Google's privacy policy at https://policies.google.com/privacy.

Transfer to third countries

A transfer of data to the USA cannot be excluded.

Storage period

The data sent by us and linked to cookies are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month.

You can also prevent the collection of data related to your use of our website which is linked to cookies (including your IP address) and the processing of this data by Google by
• not give your consent to the setting of the cookie or
• download and install the browser add-on for deactivating Google Analytics here.

You can also prevent the storage of cookies by setting your browser software accordingly. However, if you configure your browser to refuse all cookies, this may limit the functionality of this and other websites.

Legal basis and possibility of revocation

The legal basis for this data processing is your consent, Art.6 para.1 S.1 lit. a GDPR. You can revoke your consent at any time with future effect by calling up the cookie settings and changing your selection there (for further information can be found in point 8 "Use of cookies").

Further information on Google Analytics can be found in Google's Terms of Use at https://marketingplatform.google.com/about/analytics/terms/us/ and Google's Privacy Policy at https://policies.google.com/?hl=en.

10. Google DoubleClick

On this website - if you have consented to the use of cookies - DoubleClick of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, ("Google") (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, which has certified that it adheres to the Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active) is utilized. This is done to deliver ads that are relevant to you, to improve campaign performance and to prevent you from seeing the same ads more than once. For this purpose, a cookie is set to register and report your actions on the website after you have seen or clicked on one of the ads. For more information about the cookies that are set, please refer to Section 8.

DoubleClick also uses cookie IDs to track conversions related to ad requests. This is the case if e.g. you see a DoubleClick ad and later visit and purchase from the advertiser's website using the same browser.

Because of the use of Google DoubleClick, your browser establishes a direct connection with Google's server, which transfers data to Google, over which we have no control.

The legal basis for this processing is your consent.

Further information about Google DoubleClick can be found at www.google.de/intl/en/policies/privacy and at https://support.google.com/dcm/answer/9015629?hl.

11. YouTube

On this website, YouTube video content of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, ("Google") (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, which has certified that it adheres to the Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active) is embedded. For this purpose, information such as your IP address and other technical data may be transmitted to Google. If you are logged on to YouTube, Google may assign this information to your personal user account on this platform. You can prevent such assignment by logging out of your user account from the third party service before visiting our website.

Corresponding data is collected and processed in order to be able to offer you corresponding video content. This is a legitimate interest in the sense of the PDPA.

We have activated the extended data protection mode for YouTube. According to YouTube/Google, in such a case no information about the visitors is stored unless they watch a video. In such a case, a connection to the YouTube servers is established and the content is displayed on the website by notifying your browser. Due to the activation of the extended data protection mode, a "youtube-nocookie" cookie is set in order to ensure that no data is processed for video integration that is not absolutely necessary for this purpose; the legal basis for this is PDPA (legitimate interest).

The privacy policy of Google can be found at https://policies.google.com/privacy?hl=en.

12. Youku / Alibaba

This website may include content from the video portal Youku Tudou Inc. 11/F, SinoSteel Plaza, 8 Haidian Street, Beijing 100080, China ("Youku") (parent company: Alibaba Group Holding Limited).

To enable the provision of the content, information such as your IP address and other technical data may be transmitted to Youku. If you are logged on to Youku as a user, Youku may assign this information with your personal user account. You can usually prevent such assignment by logging out of your user account at the corresponding third party service before visiting our website.

In this context, data is processed in order to be able to offer you video content.

We use the necessary cookies to ensure security when browsing. The legal basis for this processing is therefore PDPA (legitimate interest in the secure operation of our services).

If you have agreed to the use of cookies, further cookies from "Alibab.com" or "Youku" will be used. This is done, among other things, for the purpose of displaying content in accordance with the settings you have made as well as for marketing (e.g. to display advertising that is in line with your interests, for conversion tracking and for measuring the effectiveness of online advertising) and statistical purposes (e.g. evaluation of user behavior). The legal basis for this is your consent.

For this purpose, data will be transmitted to Youku and possibly also to Alibaba Group Holding Limited in China. Please note that in China it might not exist the same level of data protection as in Europe and that, e.g. the enforcement of data subjects' rights or the control of further processing and transmission of data may be more difficult.

For further information on how personal data is processed, please refer to Youku's data protection information, which can be found at http://mapp.youku.com/service/flsm2018.

Part 3 – Online Profiles in Social Media

We maintain online profiles in social media so we can communicate with customers and people interested in our products and inform them about our products, services, and job opportunities with us. In the following, we want to inform you about how we process your personal data when you visit our online profiles in social media.

13. Information on all platforms

We maintain online profiles on social media of the following platform operators and at the addresses below:

Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
• Our profile: https://www.facebook.com/robatherm
• Data privacy statement of the platform: https://www.facebook.com/about/privacy/
• Information on joint processing: https://www.facebook.com/legal/terms/page_controller_addendum
• Further information on Facebook Insights: https://www.facebook.com/business/pages/manage#page_insights

Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
• Our profile: https://www.instagram.com/robatherm
• Data privacy statement of the platform: http://instagram.com/about/legal/privacy/

Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany)
• Our profile: https://www.xing.com/companies/robatherm
• Data privacy statement of the platform: https://privacy.xing.com/de/datenschutzerklaerung

Linkedin (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
• Our profile: https://www.linkedin.com/company/robatherm
• Data privacy statement of the platform: https://www.linkedin.com/legal/privacy-policy
• Cookie-Policy: https://www.linkedin.com/legal/cookie-policy

Google/ YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
• Our profile: https://www.youtube.com/robathermtv
• Data privacy statement of the platform: https://policies.google.com/privacy

Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland)
• Our profile: https://twitter.com/robatherm/
• Data privacy statement of the platform: https://twitter.com/de/privacy

Within the scope of the use of our profiles on social media, personal data are collected by different data controllers for various purposes. As soon as you visit one of our profiles, the platform operators collect and process personal data for the purpose of enabling the use of their services and possibly other purposes (see below, “Processing by platform operators”). It can also happen that you contact us about this and we collect and process personal data in the course of the contact or we process personal data that is available to us (e.g. a post) due to legal obligations (see below, “Processing by robatherm”).

Processing by robatherm

With regard to our profiles on social media, personal data are generally processed – unless described otherwise below – on the legal basis of PDPA because of our legitimate interests in public relations, communication and product improvement, unless stated otherwise herein below.
We can read posts and similar interactions on our online profiles and also see your public profile (depending on which data you have released for display). We may use this information under certain circumstances to improve our products and information, in particular on the platforms.
If you contact us via our online profiles on social media, we will process the data that you make available to us in the course of establishing contact to answer your request. Under certain circumstances, we may then answer your request via the respective platform. In this context, we would like to point out that the communication via the platform is potentially insecure and that you can contact us at any time using different channels, and you will then also receive a reply via different channels. The legal basis for this is regularly PDPA (initiation of a contract and/or performance of a contract with regard to the answering of a request).
In individual cases, it can furthermore be required that we process data posted to our online profiles on social media or transmitted to us due to legal obligations (e.g. for the purpose of transferring them to authorities or courts) or for the purpose of product monitoring and product safety (e.g. when faults of our products are reported via this channel). The legal basis for this is PDPA.
In addition, the platforms provide us in individual cases with aggregated, anonymized statistics on usage, which we use to analyze usage behavior and improve our information offer. The platform operators may have prepared these statistics, if applicable, also on the basis of personal user data. Please find more information on the relevant services and analysis options in the data privacy statements of the respective platform operators linked to above (see the separate information below regarding data processing on Facebook).
With regard to the processing activities mentioned above, you have certain rights as data subject in accordance with PDPA. Irrespective of whether we shall be regarded as the data controller within the meaning of PDPA for all of the above-mentioned processing activities in the individual case, you can, of course, also assert your rights as data subject against us. Part 1 / Number 2 applies accordingly to this extend. Please use the contact details specified in Part 1 for corresponding requests. In case we do not have sufficient influence on the respective data processing in individual cases, we reserve the right to refer individual questions to the respective platform operator to the extent permitted by law.
Please refer to the respective linked data privacy statements for further information on the possible assertion of rights of data subjects against the platform operator.

Processing by the platform operator

When accessing our profiles, personal data are processed to the extent that this is required for calling up the pages and creating user statistics by the platform operator (regarding Facebook, see the particularities in the supplementing information below). We have no influence on the processing of personal data by the platform operators. We also do not know all purposes of the processing or the storage periods nor the extent of the data collection by the platform operator. According to experience, the platforms process the data for the purposes of advertising, market research and demand-oriented design of the platforms. You can find more details in the data privacy statements of the individual platform operators linked above. As far as we have the possibility to do so, we will work towards a handling of personal data by the respective platform operators in line with the principles of data protection and data minimization. However, our possible influence is limited.

Further information

If you publish data on our social media profiles (e.g. text comments, videos, photos and other posts) or interact otherwise on them (e.g. by clicking the “like” button), these data will be processed and published by the respective platform operator. To the extent that it is possible and appears necessary to us, it can happen that, in individual cases, we or the platform operator will delete inappropriate contents published by you in accordance with the common procedures and policies of the respective platform.
Please refer to the data privacy statements of the respective platform operators linked above.

14. Supplementary information regarding Facebook

In order to generate usage statistics on Facebook (Facebook Insights) various data provided by you, including personal data, is processed by Facebook Ireland and us as joint controllers within the meaning of PDPA. The legal basis for the processing of personal data in this context is PDPA (legitimate interests or consent). The legitimate interest in this is also in informing you effectively, being able to communicate with you, and improving the information offer, in particular our profile on Facebook.
You can find the relevant information on the corresponding agreement according to PDPA between Facebook Ireland and us, and information on whom you can contact to assert your rights as a data subject at https://www.facebook.com/legal/terms/page_controller_addendum.
Regardless of the information in the referenced agreement, it is at your discretion to assert your rights as data subject against us and Facebook.
Facebook might transmit personal data to Facebook Inc. with registered office in the USA. Such a transmission takes place pursuant to the principles of the Privacy Shield (in this regard, see https://www.privacyshield.gov/welcome and https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=A...).

15. Supplementary information regarding Xing and Linkedin

If you contact us via Xing or Linkedin regarding posted jobs or otherwise for the purpose of applying for a job at our company, the legal basis for the processing of the respective data is PDPA (initiation of an employment relationship).
If you would like to apply for jobs we advertise via Xing and Linkedin and click on “apply”, you will be redirected to the website of one of our service providers. You can find more information on the processing by these providers in Part 6 – Information for job applicants – in this Data Privacy Statement.
How and for what purpose we process personal data in the context of processing job applications is also described in Part 6 – Information for job applicants.

Part 4 – Information for our customers and potential (product) buyers

The information in the following subsections relates exclusively to the processing of data from customers and interested parties, possibly also outside of our website. Unless specified otherwise below, the general information from the remaining parts (in particular Part 1) apply.

16. Type of processed data

If you, as a customer or interested party, establish business contact with us or maintain a business relationship with us, then we process the following types of personal data:
• address information,
• contact information (generally (cell) phone number, fax number, email address, including name and other details concerning contact persons or personal contact information),
• contract data,
• creditworthiness data (in this regard we are working with the credit insurer Euler Hermes, i.e. for each customer or each project, we query the commercial credit amount for the customer from Euler Hermes),
• tax-relevant information (e.g. VAT ID no.),
• support information (e.g. customer development, product or contractual interests),
• statistical data,
• billing and service data,
• banking information.

17. Purpose of processing

Data is processed for the purpose of creating offers and processing orders and delivering goods. Data is also processed for invoicing and payment. Data is processed for the performance of the contract to which you are a party or in order to take steps at your request prior to entering into a contract.
Data is also processed for the purpose of a credit check. Our interest in this consists of reviewing the solvency of a customer in order to safeguard against payment defaults. This processing safeguards our legitimate interests, whereby overriding interests of the data subject do not exist.
For the rest, data is processed for the purpose of after sales service, i.e. in order to support you in your use of our products even after a purchase. In this regard, data is processed for the performance of the contract to which you are a party or insofar as such pertains to direct marketing measures based on our legitimate interest, and subject to consent possibly to be obtained in the individual case.
If you have, in the course of an inquiry and/or the sale of one of our products, provided us with your e-mail address, we use the e-mail address to send you information about similar products and services.
You can object to this processing at any time and free of charge.
The legal basis for the processing of this personal data is - notwithstanding separate consent - our legitimate interest in such direct marketing.

18. Necessity of providing your personal data

Not all of the data listed in Section 16 are required by law. However, we cannot conclude a contract with you as a customer unless you provide this data, because this data is necessary to conclude a contract.

19. Duration of data retention

We are processing and retaining your data only for as long as necessary to provide our services. Data retention may, among other things, continue for as long as claims can be asserted against us from the provided services and/or for as long as we may require the relevant data for the purpose of a legal defense. We are also frequently obligated by law to retain the data for a longer period, generally between 5 to 10 years.

20. Transfer of data to third parties

For the purposes of the credits check listed in Section 16 and 17, our credit insurer will receive customer data (company name and address) as well as information concerning the value of goods to be insured so that the insurer can create of an offer for us.
For the rest, we are commissioning external service partners for services (e.g. rectification of defects, startup operation) at our customers. For this purpose, the service partners will receive customer data (e.g. name of the customer, contact information, address). This is for the performance of the contract to which you are a party, whereby we conclude all necessary contracts with our partners.

Part 5 – Information for our suppliers

The information in the following subsections relate exclusively to the processing of supplier data. Unless specified otherwise below, the general information from the remaining parts (in particular Part 1) apply.

21. Type of processed data

We process the following types of data of suppliers:
• address information,
• contact information (generally (cell) phone number, fax number, email address, including name and other details concerning contact persons or personal contact information),
• contract data,
• tax-relevant information (e.g. VAT ID no.),
• supplier evaluation,
• statistical data,
• billing and service data,
• banking information

22. Purpose of processing

Processing is for the purpose of creating inquiries, reviewing offers, and ordering. The data is also processed for invoicing and payment. Our interest in this regard is that we are able to order products from you. This processing safeguards are legitimate interests.
For the rest, processing is for the purpose of invoice auditing. Our interest in this regard is that we do not pay any erroneous invoice amounts. This processing is necessary for performance of the contract.
Your data is also processed for the purpose of payment. This is necessary for the performance of the contract to which you are a party.

23. Necessity of providing your data

Not all of the data listed in Section 21 are required by law. However, we cannot conclude a contract with you as a supplier unless you provide this data, because this data is necessary to conclude a contract.

24. Duration of data retention

We are processing and retaining your data only for as long as necessary for the provision of our services. Data retention may, among other things, continue for as long as claims can be asserted against us based on the provided services and/or for as long as we may require the relevant data for the purpose of a legal defense. We are also frequently obligated by law to retain the data for a longer period, generally between 5 to 10 years.

Part 6 – Information for job applicants

The information in the following subsections relate exclusively to the processing of data processed within the scope of a job application. Unless specified otherwise below, the general information from the remaining parts (in particular Part 1) apply.

25. Collection and use of personal data in the job application process – also when service providers are used

Your data is collected only to fill positions within robatherm. We keep your data confidential and do not pass it on to third parties.
If you apply for a job via the websites of other providers, your data will be gathered by the respective provider and transferred to us for the purpose of processing your job application, whereby your data will not be stored by the service providers. Furthermore, the click rates of the respective job ad will be gathered and transferred to us. In addition, the service provider will send you a confirmation when the application has been successfully sent to us and a copy of the transmitted data if requested by you. You can find the data privacy statement of those service providers in the data privacy statement on their websites.
We also cooperate with service providers that publish our job ads and merely set a link to our website to which you can then transmit your application data. In that case, no application data will be processed by the service providers and merely the click rates of the respective ad will be documented. These service providers currently include jobsDB (data privacy statement available at https://th.jobsdb.com/en-th/pages/terms/privacy-policy).
We use the click rates to analyze how worthwhile corresponding job ads are so we can improve the design of the job ads in the future. This, however, involves merely aggregated data that we cannot attribute to any specific person.
When calling up the websites of the respective service providers, the personal data are processed by the service provider to the extent that this is necessary for retrieving the pages. We have no influence on the processing of personal data by the respective service providers. Neither do we know all purposes of the processing nor the storage periods nor the extent of the data collection by the service providers. According to experience, the platforms process the data for the purposes of advertising, market research and demand-oriented design of the platforms. You can find more details in the data privacy statements of the individual platforms on their websites. As far as we have the possibility to do so, we will work towards a handling of personal data by the respective service providers in line with the principles of data protection and data minimization. However, our possible influence is limited.
Regarding the possible assertion of rights of data subjects against the respective service providers, please find more information in the respectively linked data privacy statements or the data privacy information that is accessible on the website of the respective service provider.
Irrespective of whether we shall be regarded as data controller within the meaning of the PDPA regarding the aforementioned processing activities in the individual case, you can, of course, also assert any rights as data subject arising from the respective processing activities (also such in the area of responsibility of our service provider) against us. Part 1 / Number 2 applies accordingly to this extend. Please use the contact details specified in Part 1 for corresponding requests. In case we do not have sufficient influence on the respective data processing, we reserve the right to refer individual questions to the respective platform operator to the extent permitted by law.

26. Kind of processed data

We process the following personal data within the scope of the job application process:
• your master data (e.g. first name, last name, affixes, date of birth),
• work permit/residence permit, if necessary,
• contact information (e.g. personal address, (cell) phone number, email address),
• photo, if applicable
• skill information (e.g. special skills and proficiencies),
• if relevant for the advertised position: fitness for duty.

Your personal data is generally collected directly from you within the scope of the application process, in particular from the job application documents, the job interview, and the staff questionnaire.
We may also receive data from third parties, (e.g. employment agencies).
We also process your personal data that we permissibly gain from publicly accessible sources (e.g. professional networks).

27. Purposes of the processing

Data processing chiefly serves to establish an employment relationship. The predominant legal basis for this is PDPA.
Your data is processed exclusively to fill the specific position for which you have applied.
The processing of health data may also be necessary for the assessment of your working capacity pursuant to PDPA.
If, in the event of a rejection, you wish to be included in our pool of applicants or if your application is to be taken into consideration for other vacancies in the company/group, we require a declaration of consent from you for this purpose.
If contact is initiated via corresponding service providers, the legal basis for their involvement, is PDPA if applicable (legitimate interests). Our legitimate interests are being able to organize our application processes and HR marketing efficiently. With regard to the processing of the transmitted anonymized click rates, our legitimate interest is being able to analyze the efficiency of cooperating with the service providers and improve the design of the job ads in the future.

28. Duration of data retention

If you are hired, we transfer your application records to your personnel file. After the end of your employment, the personal data that we are legally obligated to retain will continue to be stored. This generally is the based on statutory retention obligations and obligations to provide proof, which, among other things, are stipulated in the Thai Civil and Commercial Code and the Thai Revenue Code. According to these, retention periods are up to 10 years. Personal data may also be retained for the duration during which claims can be asserted against us (statutory limitation period from 3 or to up to 10 years).
In the event of a rejection, your application documents will be deleted no later than 6 months after the completion of the application process, unless you have granted us consent for a longer retention period (applicant pool).

29. Persons receiving your data

Within our company, only the persons and functions (e.g. departments) that are involved in the decision concerning your hire will receive your personal data.

30. Necessity of providing your data

To consider your application, we require from you the personal data necessary for the decision or to establish the employment relationship. A statutory obligation to provide data does not exist.

31. Information concerning encryption of applicant data and other information

Your online application data will be encrypted and transferred with state-of-the-art technology. If you transmit an unsolicited online application to robatherm or apply for a current vacancy, your application data will be stored in our software-based applicant management system.
From processing technology aspects, your written application will be handled like an online application. Your original documents will be returned to you at the latest upon conclusion of the staffing process.