Privacy Notice

1. Who this notice applies to

This notice applies to every applicant who submits an application through the careers page of the Company’s website, and to anyone who sends a CV to the Company directly by email. If you are hired, your data will instead be governed by the employee privacy notice, which the Company will provide to you.

2. Data controller and contact

Bluroca Co., Ltd. is the data controller for the information you submit through the application form.

• Registered name: Bluroca Co., Ltd.
• Juristic person registration number: 0745569007435
• Registered office: 99/44 Moo 4, Ekkachai Road, Khok Kham Subdistrict, Mueang Samut Sakhon District, Samut Sakhon
• Responsible for applicant data protection: the Human Resources department
• Email: recruitment@bluroca.com

3. Personal data we collect

• First name and last name.
• Contact details as you provide them: email address, phone number, LINE ID, Facebook, and LinkedIn.
• Any message or additional detail you enter in the form.
• Supporting documents such as a resume or CV and anything else you attach, including the information they contain, such as your education and employment history.
• Technical data, namely your IP address and browser information, used for security and to prevent automated submissions.
• The date and time of your application and the application reference number generated by our system.
• A record of your consent: that you gave it, the date and time, and the version of this notice you agreed to.
• Records we create while assessing you: the status of your application, internal notes made by our recruitment team about it, and which member of staff reviewed it. These are your personal data, and you may request access to them under clause 12.

Sensitive personal data. The Company does not seek to collect sensitive personal data under Section 26 of the PDPA, such as race, religion, disability, criminal record, health data, or biometric data. Please do not include such information, and please do not attach photographs, copies of your national ID card, or copies of your house registration. If you provide such data voluntarily, the Company will treat this as your explicit consent to collect and use it for recruitment purposes only, and will remove anything unnecessary once identified.

4. Sources of personal data

• Directly from you, through the application form and the documents you attach.
• From public sources you have published yourself, such as a LinkedIn profile you list in your application.
• From referees you name, or from a referrer, only where you have already given consent.

5. Purposes and lawful bases for processing

The Company processes your personal data for the following purposes.

• Assessing your qualifications and suitability for the role — on the basis of steps taken at your request prior to entering into a contract (Section 24 (3)) and on the basis of consent (Section 19).
• Contacting you, arranging interviews, and notifying you of the outcome — on the same bases as above.
• Keeping your profile on file for other openings in future, within the period in clause 9 — on the basis of consent (Section 19).
• Maintaining the security of our systems and preventing improper submissions — on the basis of legitimate interest (Section 24 (5)).
• Complying with applicable law — on the basis of legal obligation (Section 24 (6)).

The Company does not use applicant data for marketing purposes and does not sell your personal data to anyone.

6. If you do not provide the data

The fields marked as required in the form are the data the Company needs in order to consider your application and to contact you. If you do not provide them, or if you later withdraw your consent, the Company may be unable to proceed with your application or to contact you about the role. Not providing the data has no consequence for you beyond what is stated here.

7. Disclosure of personal data

The Company may disclose your data to the following, only so far as necessary.

• Directors and employees of the Company involved in the recruitment process.
• IT service providers used by the Company to store data and to send and receive email, acting as data processors under contracts imposing confidentiality obligations and data protection measures.
• Government agencies or regulators, where the Company is under a legal duty or lawful order to do so.

8. Cross-border transfer

The data storage and email systems the Company uses may have servers located outside the Kingdom of Thailand. Where that is the case, the Company will ensure appropriate personal data protection measures are in place, in accordance with the legal requirements for transferring data abroad.

9. Retention period

The Company will retain your personal data and application documents for no longer than one yearfrom the date you submit your application. Once that period has passed, the Company will delete the data or render it non-identifiable.

Except where you are hired, in which case your data will be transferred and retained as part of your employee file for the period required by labour law and other applicable legislation.

10. Security measures

The Company maintains appropriate technical and organisational security measures to prevent loss, unauthorised access, use, alteration, modification, or disclosure of data. Application documents are stored in private storage with access restricted to the relevant Human Resources staff, and data transmitted between your browser and the Company’s systems is encrypted.

11. Cookies

The use of cookies on the Company’s website is governed by the Cookie Policy. The application form uses only those cookies necessary for the system to function and to prevent automated submissions.

12. Your rights as a data subject

Subject to the conditions set by law, you have the following rights.

• Right of access and to obtain a copy of your personal data (Section 30).
• Right to data portability — to have your data transferred to another data controller (Section 31).
• Right to object to the collection, use, or disclosure of your personal data (Section 32).
• Right to erasure or destruction, or to have your data rendered non-identifiable (Section 33).
• Right to restrict the use of your personal data (Section 34).
• Right to rectification — to have your data made accurate, current, complete, and not misleading (Section 35).
• Right to lodge a complaint with the Personal Data Protection Committee (Section 73).

You may exercise these rights by contacting recruitment@bluroca.com The Company will act on your request without delay and in any event within 30 days of receiving it, in accordance with Section 30 paragraph four. If the Company refuses a request, it will record the refusal together with the reasons for it, as required by law.

13. Withdrawing consent

You may withdraw your consent at any time by writing to recruitment@bluroca.com Withdrawal does not affect any collection, use, or disclosure already lawfully carried out. However, withdrawing consent may mean the Company can no longer continue to consider your application, as set out in clause 6.

14. Changes to this notice

The Company may update this notice from time to time to reflect changes in the law and in practice. The most recent version will be published on this page together with the date it was updated.

15. Contact and complaints

If you have questions about this notice, or wish to exercise your rights as a data subject, please contact the Human Resources department at recruitment@bluroca.com

If you consider that the Company has not complied with the PDPA, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) under Section 73.

16. Governing law

This notice is governed by Thai law, and the Thai courts have jurisdiction over any dispute arising out of or in connection with it.

17. Language

This English text is a translation provided for convenience. In the event of any inconsistency between it and the Thai text, the Thai text prevails.