Announcement of Synchrotron Light Research Institute (Public Organization)

on Personal Data Protection Policy B.E. 2565

 

---

          Due to the duty of Synchrotron Light Research Institute (Public Organization) in collecting, compiling, using, and disclosing personal data of officers and other individuals for operation purposes, the institute deems appropriate to regulate the personal data protection policy in accordance with the Personal Data Protection Act B.E. 2562 for effective work process and appropriate and qualified method of personal data protection.

          Pursuant to the Decree of Board of SLRI, Ref. No. 7/2020, on “Appointment of Director of Synchrotron Light Research Institute” issued on 29 May 2020, SLRI hereby issues the Announcement with details as follows:

          Item 1 This announcement is called the “Announcement of Synchrotron Light Research Institute (Public Organization) on Personal Data Protection Policy B.E. 2565”.

          Item 2 Definitions

          “SLRI” means Synchrotron Light Research Institute (Public Organization).

          “Individual” mean a general person.

          “Personal data” means data relating to and can identify, either directly or indirectly, to an individual such as name, surname, nickname, address, telephone number, national identification number, passport number, social security number, driving license number, tax identification number, bank account number, credit card number, email address, car registration number, title deed, IP address, cookie ID, Log file, etc. The following data is not considered as personal data: data for business contact without personal identifying, company name, company address, juristic person registration number, company telephone number, business email address, company email address such as This email address is being protected from spambots. You need JavaScript enabled to view it., anonymous data or pseudonymous data, data of the decease, etc.

          “Sensitive personal data” means data relating to an individual and is sensitive and may cause discrimination to the individual such as data regarding nationality; ethnicity; political opinion; belief of religious doctrine, religion, or philosophy; sexual behavior; criminal record; health data; disability-related data; genetic data, biometric data, or other data possibly causing the same impact on the data subject as determined by the Personal Data Protection Committee.

         “Data subject” means a general person who owns personal data but is not a person who collects and/or processes personal data. Data subject refers to a general person only and does not refer to a “juridical person” authorized by law such as company, association, foundation, or other organizations.

          In this regard, data subjects include individuals stated below.

          (1) A data subject who become his/her legal age as follows:

                    a. a person at the age of 20 or older, or

                    b. a person who is married at the age of 17 or older, or

                    c. a person who is married before the age of 17 with the court’s permission, or

                    d. a minor whose legal representative has given consent to carry on trade or other business, or to enter an employment contract as an employee, and in relation to such business or employment, the minor shall have the same capability as a person of legal age.

                    In this regard, for the purpose of giving consent, the data subject of legal age can give consent of his/her personal data.

          (2) A minor data subject means an individual below the age of 20 and not of legal age as stated in (1). For the purpose of giving consent, the minor needs to gain consent of a person with the parental power to act on behalf of the minor.

          (3) A quasi-incompetent data subject means an individual judged by the court to be quasi-incompetent because of physical or mental infirmity, habitual prodigality, habitual intoxication, or other similar causes. A quasi-incompetent data subject is incapable to manage his/her own affairs or manage them to the detriment of their own property or family. For the purpose of giving consent, a quasi-incompetent data subject needs to gain consent of the curator with the power to act on behalf of a quasi-incompetent data subject.

          (4) An incompetent data subject means an individual judged by the court to be incompetent due to unsound mind. For the purpose of giving consent, the incompetent data subject needs to gain consent of the guardian with the power to act on behalf of the incompetent data subject.

          In case of a request for data subject’s consent which does not proceed in compliance with the personal data protection law, it shall not be binding upon the data subject.          

          “Data controller” means a general or juridical person having authority of collecting, using, or disclosing personal data.

          “Data processor” means a general or juridical person working in relation to collection, use, or disclosure of personal data according to the order or on behalf of the data controller. The data processor must not be the same person as data controller.

          Item 3 Source of Personal Data

          SLRI generally does not collect personal data, except for the following cases:

          (3.1) SLRI receives personal data directly from data subject in the following services processes:

                    (1) a process of a request for SLRI’s services such as use of synchrotron light, receiving of information, job application, etc.

                    (2) collection of data willingly provided by a data subject such as via survey, or correspondence via email address or other channels of communication between SLRI and a data subject.

                    (3) collection of data from SLRI official website via browser’s cookies of a data subject and electronic transaction.

          (3.2) SLRI has received personal data of a data subject from a third party which SLRI believes in good faith that such the third party is entitled to collect and disclose such personal data to SLRI.

          Item 4 Objectives of Personal Data Processing

          SLRI shall collect, use, and disclose personal data only to the extent necessary by using legal and rightful methods for services provision, publication, information presentation, or request for data subject’s opinion on SLRI’s services or activities under SLRI’s work purposes or in conforming to law only. In the case change of SLRI’s objectives occur, SLRI shall inform data subject, record the change as reference, and perform in accordance with the law of personal data protection.

          Item 5 Processing of Personal Data

          (5.1) Collection of Personal Data

          SLRI shall limit the collection of personal data to the extent necessary depending on the category of services used by a data subject or personal data provided to SLRI such as registration for activity participation, request for use of services, both directly to SLRI and via SLRI’s information system. Such personal data shall be collected only to the extent necessary.

         (5.2) Use of Personal Data

         SLRI shall use personal data in conforming to the purposes for which such personal data is provided by the data subject to SLRI and shall provide measures to ensure personal data security and control access to such personal data.

         (5.3) Disclosure of Personal Data

         SLRI shall not generally disclose any personal data, except for the purposes for which personal data is provided by the data subject to SLRI such as disclosure of personal data for the services requested by the data subject or in compliance with contractual obligation or as required by law. In the cases SLRI is required to collect, use, or disclose additional personal data or change the purposes of such collection, use, or disclosure, SLRI shall inform a data subject prior to processing such personal data, unless required or permitted by law.

         Item 6 Period of Personal Data Retention

         SLRI shall retain personal data as long as it is necessary for processing and shall destroy such personal data after completion of such period.

         Item 7 Rights of Data Subject

         The consent given to SLRI by a data subject on collecting, using, or disclosing personal data shall remain valid until data subject withdraws such consent via written notice. The data subject can withdraw the consent or repeal the use or disclosure of personal data for SLRI’s implementation of some or all activities by sending either the written request via letter or electronic mail to This email address is being protected from spambots. You need JavaScript enabled to view it..

         Apart from the above stated rights, a data subject also owns the following:

         (1) Right to Withdraw Consent

                   The data subject has the right to withdraw the consent of data processing provided to SLRI at all times throughout the period such personal data is retained at SLRI.

        (2) Right of Access

                  The data subject has the right to access personal data, request SLRI for copies of such personal data, and request SLRI to disclose how SLRI obtains personal data without gaining the data subject’s consent.

        (3) Right to Rectification

                  The data subject has right to request SLRI to rectify the incorrected or fill in the incomplete personal data.

        (4) Right to Erasure

                  The data subject has right to request SLRI to erase personal data for some reasons.

        (5) Right to Restriction of Processing

                  The data subject has right to restrict SLRI’s processing of personal data for some reasons.

        (6) Right to Data Portability

                  The data subject has right to have SLRI transfer the provided personal data to other data controller or the data subject him/herself for some reasons.

        (7) Right to Object

                  The data subject has right to object SLRI’s processing of personal data for some reasons.

                  SLRI respects the data subject’s decision to withdraw the processing of personal data. However, data subject shall be informed of possibly limit in the right of objection in accordance with law or contracts beneficial to the data subject. The consent withdrawal does not affect the previous consent of the data subject in collection, use, or disclosure of other parts of personal data.

        Item 8 Maintaining of Personal Data Security

        SLRI provides appropriate security measures to prevent unauthorized or unlawful access, use, change, amendment, or disclosure of personal data. Moreover, SLRI sets out the internal procedure to authorize the right to access or use personal data in order to preserve personal data security. SLRI shall review such measures from time to time for appropriateness.

        Item 9 Use of Cookies

        Cookies mean small-sized data which websites send to be stored with the data subject while visiting the websites to help keeping visiting track of data subject such as the most preferred language, system user, or other settings. On the data subject’s next visit to the website, the website shall recognize data subject of preferences and apply such settings previously selected by the data subject until data subject delete or disable cookies. The data subject can accept or refuse cookies. If cookies are refused or deleted, the website may not be able to provide the services or display correctly.

        Item 10 Update of Personal Data Protection Policy

        SLRI may update or amend the personal data protection policy without prior notice to data subject for the appropriate and efficient policy. Therefore, SLRI hereby advises data subject to read the policy at every visit or use of service from SLRI official website.

        Item 11 Compliance with Personal Data Protection Policy and Contact SLRI

        In the case a data subject has question or suggestion regarding the personal data protection policy or compliance with this personal data protection policy for improvement of SLRI personal data protection and services, please contact SLRI at an email: This email address is being protected from spambots. You need JavaScript enabled to view it. or the following address:

          

Synchrotron Light Research Institute (Public Organization)
111 Sirindhorn Witchothai Building, Village No. 6, University Avenue,
Suranaree Sub-district, Muang District, Nakhon Ratchasima, 30000

 

 

 

                                                                                                                         issued on 28 January 2022

                                                                                           

                                                                                                            Associate Professor Dr. Saroj Rujirawat

                                                                                                                                        Director