Employee Data Protection Policy

1) Introduction and scope

This policy covers the collection, use, disclosure, transfer, retention, and deletion of personal data of job applicants, employees (all types), contractors working like employees, and former employees of Tanqory and its affiliates in all countries.
Use together with the Privacy Policy, Data Classification, Data Retention, DPA, Security Standards, and applicable labor/immigration laws; if conflicts arise, follow the stricter/more specific document or the strictest legal requirement.
Personal data processed must be necessary under the principles of data minimization and purpose limitation; continued use after notice constitutes acceptance under applicable legal bases (e.g., contract/legal obligation/legitimate interests/consent).
The binding language is English; the Thai version is for understanding. If inconsistent, English controls.
Security/legal emergencies may require immediate measures; notice will be provided via email/dashboard (durable medium) as soon as possible.
Scope includes digital, physical, and verbal data that is recorded or transcribed in systems controlled by the company.
Contact channels: hr@tanqory.com, dpo@tanqory.com, security@tanqory.com, info@tanqory.com

2) Principles and legal bases

Comply with data, labor, and immigration laws in each country, aligned with GDPR/PDPA/CCPA principles (lawfulness, fairness, transparency, minimization, accuracy, storage limitation, integrity/confidentiality, accountability).
Legal bases include employment contracts, legal obligations (tax/social/immigration/labor), legitimate interests (security/IT/training), and consent (voluntary activities such as additional health screening/promotional photos).
Sensitive data (health/biometric/belief/union membership) is used only where legally required or with explicit consent, or to protect life/public health.
Minors (interns below the age of majority): comply with local age thresholds and obtain guardian consent where required.
LIA/DPIA/DTIA will be performed for high-risk processing (e.g., monitoring behavior, CCTV in sensitive areas, performance profiling, transfers to countries without adequacy).
Respect employee rights (access/rectify/erase/restrict/port/object/withdraw) per applicable law and avoid automated decision-making without human review where prohibited.
No unlawful discrimination; do not use data beyond the stated purposes.
Where consent is relied upon, choices must be freely given and can be withdrawn at any time without affecting legally protected employment rights.
Records of processing (ROPA) and consent records are maintained per retention policy.

3) Data categories and purposes

Identity/contact: name, date of birth, address, phone, email, emergency contact to administer employment/communications/safety (bases: contract/legal obligation/legitimate interests).
Right-to-work documents: ID/passport/visa/work permit to comply with immigration/labor laws (legal obligation).
Payroll/benefits: bank details, tax, social security, health benefits/insurance to pay wages and administer benefits (legal obligation/contract).
HR/performance: role, performance reviews, OKR/goal setting, training records to manage performance and career development (contract/legitimate interests).
System access/security: accounts, logs, access badges, CCTV (work areas), MFA tokens to secure systems/prevent fraud/investigate incidents (legitimate interests/legal obligation).
Necessary health data: medical certificates/workplace adjustments/accident records to comply with labor/safety laws and provide welfare (legal obligation/consent/public health interest).
Recruitment data: education/work history/references/tests to assess hiring (pre-contract/consent/legitimate interests).
Media/event photos: used for internal/external communications on a voluntary basis or legitimate interests with opt-out where legally required.
Data classification levels (Public/Internal/Confidential/Restricted) apply per the Data Classification Policy.

4) Disclosure and transfers

Internal: only need-to-know (HR, Finance/Payroll, IT/Security, line managers) under access controls and NDAs.
External: payroll/benefits/insurance/medical assessment/legal/audit/training providers, government agencies (tax/labor/immigration), banks/payment processors.
All providers must sign a DPA or equivalent obligations, cannot use data beyond scope, and must delete/return data at end of service.
Cross-border: use SCCs/UK IDTA/BCR or appropriate legal bases and perform DTIA/TRA per EDPB/ICO guidance when exporting to countries without adequacy; employees will be notified in relevant notices.
Do not transfer data to sanctioned territories unless required by law/government order.
Use of cloud/HR/IT/AI tools abroad requires adequate technical/organizational measures (encryption, access control, logging).
Disclosures under court/government orders will follow law; notice will be given where permitted.
No selling/renting employee data for third-party marketing.
CCTV is for safety/investigation, not facial recognition or deep behavioral analytics unless law/explicit consent permits.
Health/sensitive data is disclosed only to those with a necessary role (occupational health/insurer) under the relevant legal basis.

5) Security and access

Apply least privilege/need-to-know, MFA for systems with employee data, encryption at rest/in transit (AES-256/TLS1.2+), logging, and DLP for Confidential/Restricted data.
Separate roles between HR/Payroll/Manager/IT and log audits of access/download/forwarding.
Devices accessing employee data must be managed via MDM/EDR with full-disk encryption; personal devices without protection must not be used to transmit employee data.
Encrypted backups with recovery tests; backups follow retention/deletion cycles.
Incident response playbook (detect-contain-notify-remediate-review); notify within 72 hours or per law if high risk.
Encryption keys and identifiers (ID/health) are classified as Restricted per Data Classification Policy.
No personal channels (email/drive/messenger) for employee data unless approved and sufficiently protected.
Printing L3/L4 data requires controlled storage/destruction; do not leave in public areas.
Access to health data is limited to HR/assigned medical personnel under specific NDAs.
Conduct vulnerability scans/pentests periodically and remediate promptly.

6) Retention and deletion

Follow the Data Retention Policy as primary reference. Typical periods: employment/tax/social data 7–10 years (strictest law), security logs 1–3 years, consent/rights requests during employment + 7 years.
Recruitment data for unsuccessful candidates retained 12–24 months (per law/consent) then deleted/anonymized.
Health data/medical certificates kept only as necessary for the purpose/legal obligation and deleted when no longer needed.
Data in backups/archives will be deleted in the next feasible cycle and not restored to normal use.
Data under legal hold is suspended from deletion until Legal lifts the hold.
Upon termination, delete/segregate unnecessary data and retain only what is required by law/disputes.
Deletion uses secure delete/cryptographic erase with evidence recorded upon request.
No shadow copies outside corporate systems.
Employees may request deletion of certain data subject to legal/contract constraints.
Retention snapshot is in Annex A (reference) and will be updated when laws/contracts change.

7) Employee rights and SLA

Rights: access/copy, rectify, delete (where not conflicting with law/contract), restrict, port, object, withdraw consent, and the right not to be subject to automated decision-making without human review where prohibited.
Submission channels: dpo@tanqory.com or HRIS form; identity verification required before processing.
SLA: acknowledge within 2 business days, update every 10 business days, target close 30 days or notify if longer/complex.
Requests affecting compliance/disputes/third-party rights may be denied with reasons.
For backup/multi-tier systems, deletion will follow feasible cycles and timelines will be communicated.
No fees unless requests are repetitive or unfounded as permitted by law.
Complaint avenues: PDPC (SG), PDPC (TH), ICO (UK), EU DPAs, relevant data/labor regulators, US consumer agencies.
Verification data is used only to process the request and deleted when no longer needed.
Notices/explanations will be provided in clear English/Thai where appropriate.
Requests involving health data may require additional documents to verify rights and protect privacy.

8) Service providers and sub-processors

Use HR/Payroll/IT/insurance/health check/training providers under DPA/SCC/IDTA or equivalent mechanisms with deletion/return obligations at end of service.
Latest sub-processor list is published on the dashboard/Annex D of the DPA; material additions will be notified via durable medium with reasonable right to object.
Assess provider security/legal posture before onboarding and monitor periodically.
Limit sharing to data necessary for stated purposes and classification levels.
Providers handling health/sensitive data must apply stricter safeguards and specific NDAs.
Providers may not use employee data for their own purposes (e.g., model training/marketing) unless explicitly authorized and legally permitted.
Share only the least data necessary.
Review provider access periodically and revoke when no longer needed.
Provider breaches must be reported per contract and cooperatively investigated/remediated.
Cross-border transfers to providers follow Section 4 and the DPA.

9) Communication, training, and enforcement

Employees/contractors accessing employee data must complete privacy/security training before start and at least annually thereafter.
Publish policy/updates via email/dashboard (durable medium); keep training records to evidence compliance (ISO/SOC/laws).
Provide quick-reference materials (cheat sheet/FAQ) on data levels, storage, sharing, deletion, and employee rights.
“Report-first” culture: report anomalies/suspected leaks immediately to security@tanqory.com or internal channels.
Violations may lead to disciplinary action, termination, or regulatory reporting depending on severity.
Lessons from incidents/audits/complaints will improve policies/processes.
Managers must support and monitor team adherence to policies and training.
Communications will use plain language and avoid unnecessary jargon.
Keep evidence of notices/major announcements in accessible systems for audit.
Assess training effectiveness via quizzes/feedback and improve continually.

10) Incident reporting and complaints

Report high-risk privacy/security incidents to security@tanqory.com and dpo@tanqory.com immediately; Tanqory will assess and notify per law (e.g., GDPR 72 hours, PDPA SG 3 days for notifiable cases).
Notify affected employees with necessary details (data types/risks/mitigation) to the extent law/safety allows.
Complaints/questions on employee data go to hr@tanqory.com or dpo@tanqory.com; if unsatisfied, complaints may be escalated to relevant data/labor regulators.
Record incidents/complaints and responses to demonstrate compliance and drive improvements.
Health/sensitive data incidents follow stricter handling and confidentiality.
Services/systems may be limited temporarily to contain incidents; communication will follow promptly.
Post-incident reviews will close gaps and enhance measures.
Internal whistleblowing channels may be used if reporting via supervisor/HR is not feasible.
For compromised accounts, password/MFA resets will be enforced and access logs reviewed.
Data restoration from backups after incidents will avoid reintroducing data previously deleted on request.
Emergency notifications/material changes will be sent via email/dashboard (durable medium) for accessibility and record.

Annex A: Snapshot retention periods for employee data (quick reference)

• Binding periods follow the Data Retention Policy/local law/Order Form if different from this snapshot.

Change history