Announcement of JSSR Group Public Company Limited

on Employee’s Personal Data Processing

Board of Directors of JSSR Group Public Company Limited (“the Group Company”) which consist of 1) JSSR Auction Company Limited 2) JSSR Logistics Company Limited 3) Rapbizz Direct Company Limited, as the employer and person in charge of managing employee protection and benefits to the Employee of the Group Company issue this Group Company Announce on Employee’s Personal Data Processing (the “Announcement”) for the Employee to acknowledge and understand their rights and any conditions relating to the collecting, storing, processing; and/or disclosing of their personal data that the Group Company shall process as defined hereunder

Under this Announcement, the “Employee” shall include the directors, executives, employees, workers under employment agreement, (2) internship, and (3) ex-employees who enter in to hire of work agreement as a consultant (“Employee”) of the Group Company.

Clause 1 Announcement Name and Effective Date     

1.1    This Announcement is called “Group Company’s Announcement regarding Employee’s Personal Data Processing” and shall become fully effective from the date of announcement and shall apply to all the Employees.

1.2    The Group Company may amend this Announcement from time to time in order to assure the compliance of this Announcement with the relevant laws and regulations as well as to reflect any change in employment arrangement or benefits; provided that the Group Company shall notify the Employee of those amendments and those amendments shall become effective upon announcement. 

Clause 2 Definition of Personal Data    

“Personal Data” shall refer to any information that can identify each individual Employee that the Group Company may collect from various sources: (i) directly from the Employee; (ii) indirectly from the service providers who have been engaged by the Group Company to provide relevant benefits or management to the Employee; or (iii) from the compilation, evaluation and preparation undertaken by the Group Company as the employer during the employment term. 

Clause 3 Employee’s Personal Data that shall be processed include: 

3.1    full name, identification number and copy of the identification card, age, nationality, date of birth and other qualifications relating to the Employee that the Employee may give to the Group Company under the job application form and the employment agreement;

3.2    contact information, including address as defined under the identification card, current address, telephone number, email, or other communication channels;

3.3    payment information that the Group Company make to the Employee, including bank account, payment history, social security number, benefit provisions information, provident fund information and any other details of the Employee’s benefits claims;

3.4    working experience and training information, including work attendance and leave information recorded in the record system in various forms and the capability evaluation and testing result;

3.5    upon the obtainment of the explicit consent from the Employee, the sensitive Personal Data, including biometric information (i.e., fingerprint and facial recognition), health information (including annual health checkup information, medical certificate, medical bill of treatment, vaccines, any medical condition).;

3.6    portrait and video recorded during the participation in the Group Company’s event, including any internal social gathering or external event;

3.7    full name, signature as filled and recorded in any documentation prepared in the business operation of the Group Company; and

3.8    other Personal Data that the Employee may give to the Group Company for the assessment, analysis, management, or arrangement of other employee benefits that the Company may provide to the Employee, including the Personal Data contained in the questionnaire or event registration form.

Clause 4 Processing of the Personal Data of Employee’s Related Person

4.1     The Group Company provide benefits to the Employee’s family members or related persons (the “Related Person”) both directly to those Related Persons and the benefit granted to those Related Person acting as the Employee’s beneficiary. In order for the Group Company to provide those benefits, the Group Company would need to collect, store and use the Personal Data of the Related Persons, including without limitation, full name, contact information as well as the identity documentation and in case of any claim and consent granted, may include the health information of those Related Person.

4.2    In case the Employee provide the Personal Data of such Related Person to the Group Company, the Group Company shall deem that the Employee represent and warrant that he/she has the legitimate right to disclose such Personal Data and have informed the Related Persons of the necessity to process their Personal Data and have obtained relevant consent from the Related Person already.

Clause 5 Objectives of the Personal Data Processing

Based on the framework of: (1) performing the legal obligation to protect the Employee; (2) performing the contractual obligations under the employment agreement; and (3) protecting the legitimate interest, the Group Company would need to process the Employee’s Personal Data for the following purposes:

5.1    To perform the Group Company’s legal obligations under applicable laws, regulations, guideline, instruction, notice issued by the regulatory authorities, the Group Company would need to process the Employee’s Personal Data, in particular for the following specific objectives: to facilitate and/or manage tax payment filing for the Employee; to prepare the Employee registration; to register for social security; to manage provident fund; to provide relevant training and skill development; to protect labor in general; to manage the Employee’s occupational health; and may include to apply for the authorization relating to immigration and work permit (in case of foreign Employees);

5.2    To perform right and obligation of the Group Company as employer under employment agreement that may include to control, manage relationship between the Group Company and Employee, including without limitation to process those Personal Data for the following purpose, the Group Company would need to process all Personal Data of the Employee:

1.     To manage wages and salary payment; to assess, supervise and/or evaluate the Employee’s performance; and to set and manage the achievement of the Employee’s progress and achievement;

2.     To consider the Employee’s suitability and performance for promotion and rewarding program that the Group Company may provide to the Employee; to design the training and skill improvement (either held by the Group Company or other persons); to enforce sanction against the Employees who may not act in accordance with or may violate the Employee’s obligations as defined under the employment agreement or other labor regulations which is an exercise of the Group Company’s rights as an employer under employment agreement;

3.     To manage and/or supervise the provision of the employment benefits and welfare under the employment agreement, for instance, in the insurance and compensation claim or health protection and management (for the Employee or the Related Person that the Group Company may provide under the employment agreement);

4.     To contact and coordinate with the Employee for the purpose of supervising and managing the relationship between the Employee and the Group Company, or in the emergency circumstances;

 

5.3    In order to manage internal risk and to exercise of the Group Company’s legitimate right, that the Group Company would need to process the Employee’s Personal Data for these specific purposes:

1.     To conduct research and development activities (including without limitation to conduct surveys or questionnaires to gathering of useful information); to develop any infrastructures, welfares, privileges and any facilities; research for develop products or services of the Group Company; as well as research conducted to improve employment relationship between the Employee and the Group Company;

2.     To proceed in the legal procedures; to proceed in reclaiming the legitimate rights that the Group Company may have; to demand for the compensation; to defend a lawsuit; or to manage any complaints made;

3.     To keep records and statistics, legal reports and/or any other record as required to be prepared by the Group Company and/or the affiliates company;

4.     To prepare PR marketing material of the Group Company which may disclose and present Employee’s Personal Data that may include without limitation to photo or qualification and expertise of those Employee; provided that such material will be used, disclosed and published both electronically and on paper;

5.     To respond and manage the enterprise risk, conflict of interest, internal control and audit procedures through various proceedings; and to check the track record of the Employee upon the termination of the employment agreement in case the Employee re-applies for the job; and

6.     To collect and control the back-up and recovery process of the Employee’s Personal Data;

5.4    In case of the consent given by the Employee, the Group Company shall process the Personal Data for the purposes defined in the consent.

Clause 6 Retention Period of the Personal Data

6.1    The Group Company would need to retain and store the Employee’s Personal Data throughout the employment terms of each Employee and for the period of time that the Group Company shall be obliged under the relevant laws to store such Employee’s Personal Data.

6.2    For the purpose of defending and claiming for the legitimate rights between the Group Company and the Employee under the employment agreement and labor protection laws, without causing excessive impact on the Employee’s right, the Group Company reserves the right to retain the Employee’s Personal Data for the appropriate prescription period of 10 years after the termination of employment agreement.

6.3    For the use of the Employee’s Personal Data for publication, statistics or other reports, the Group Company reserve the rights to keep those Employee’s Personal Data for as long as the Company consider necessary for their business operation. 

Clause 7 Disclosure of the Personal Data

For benefit of labor protection and provision of any welfare that stipulated in employment agreement and under the relevant laws, the Group Company would need to disclose the Employee's Personal data to these following third parties for one or more purposes as specified:

7.1    To Group Company’s customers, vendors or any other third-party service providers being engaged to manage the Employee’s benefits and interest for and on behalf of the Group Company, including without limitation insurance providers, human resources and human development service provider, other supporting consult (i.e., the payroll or benefit design and processing consultant or IT service providers), the consultant or service providers involved in the legal proceedings brought by and against the Group Company; provided that the disclosure of such Personal Data shall be done only on the need to know basis pursuant to the data processing agreement entered into and between the Group Company and such third party;

7.2    To any third party involved in the organizational restructuring, merger and acquisition, sale, joint venture, assignment, transfer or any form of distribution of all or part of the Group Company’s business, assets or stock of the Group Company, either the person who has been involved during the offer or committed transaction or any person involved in the insolvency or any similar process; provided that the disclosure of such Personal Data shall be done only on the need to know basis pursuant to the data processing agreement entered into and between the Group Company and such third party;

7.3    To government or regulatory authorities including revenue department, social security office, labor skill development, labor recruitment agency, courts and tribunals in dispute resolution or any other government authorities that the Group Company may be subject to an order, law, or judgment to disclose the Employee’s Personal Data to those authorities: and

7.4    To any other person that Employee have given explicit consent to the Group Company to disclose the Personal Data to.

Clause 8 Representation to implement appropriate information security measures

8.1    The Group Company undertake to implement the appropriate information security measures to prevent the unauthorized access, amendment or disclosure of the Personal Data and the Group Company commits to review those measures on a regular basis in order to ensure its compatibility to the standards and laws;

8.2    In case any Employee being assigned to work in the position that can get access to or is designated to process any Personal Data, the Employee shall acknowledge and assume the obligation to keep the information security of the Personal Data within their possession and the Employee shall indemnify and hold the Group Company harmless from any damages that the Group Company may suffer from the failure to comply with the information security obligation of such Employee.

Clause 9 Employee’s Rights as the Data Subject

The Group Company confirm the Employee’s right that related to personal data as follows:

9.1        Right to access and receive a copy of personal data including the right to request for the correction and update of the Personal Data;

9.2        Right to request for data portability including the right to transmit or transfer data portability to any data controllers;

9.3        Right to object to the process of Personal Data being undertaken by the Group Company;

9.4        Right to request for the deletion or de-identification your personal data upon there is no necessity to process or the data subject revoke the consent 

9.5        Right to request the Company to suspend the use of the personal data upon there is no necessity to process  

9.6        Right to withdraw consent that the Employee have given to the Group Company;

The Group Company will consider the request and notify Employee of the Group Company’s determination within a reasonable period to the extent under the applicable laws. The Employee can request to exercise the defined rights by contacting at [email protected].