CCTV Privacy Notice

RICOH (Thailand) Limited and RICOH Services (Thailand) Limited (“Company”) place importance on the protection of personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019). Therefore, this Privacy Notice has been prepared to inform you of the details relating to the collection, use, and disclosure of personal data through the use of closed-circuit television (CCTV) within the Company’s premises, as follows:

1. Scope of Application of this Privacy Notice

This Privacy Notice applies to all individuals who enter areas where the Company’s CCTV cameras are installed, including but not limited to employees, visitors, customers, business partners, contractors, and any other persons who enter the Company’s buildings or premises. Such individuals are collectively referred to as “data subjects,” “customers,” or “you.”

2. Personal Data Processed by the Company

The Company installs CCTV cameras in visible locations and places signage indicating the use of CCTV at entrances and exits, as well as in areas that the Company deems appropriate for surveillance. The Company collects your personal data when you enter such areas, as follows:

• Still images and motion images
• Audio (in certain areas where the cameras support audio recording)
• Images of your property, such as vehicles, accessories, and clothing

However, the Company will not install CCTV cameras in areas that may excessively infringe upon your fundamental rights, including restrooms or areas designated for employee rest.

3. Sources of Personal Data

The Company obtains personal data directly from CCTV cameras installed at various locations within and around the Company’s premises.

4. Purposes of Collection, Use, and Disclosure of Personal Data 

The Company collects, uses, and discloses your personal data based on the legal bases of legitimate interests, legal obligation, legal claims, vital interests, purposes related to medical management, social protection and labor protection, and other lawful bases permitted under personal data protection laws, solely for the following purposes: 

• To protect your health, personal safety, and property, as well as those of the Company
• To protect the Company’s buildings, facilities, and assets from damage, disruption, destruction, or other crimes
• To support relevant authorities in law enforcement, such as deterrence, prevention, investigation, and legal proceedings
• To assist in dispute resolution processes occurring during disciplinary or complaint procedures
• To assist in investigation processes or complaint handling procedures
• To assist in initiating or defending legal proceedings, such as exercising rights in civil or labor cases

In the event that the Company is required to collect your personal data for the performance of a contract or compliance with the law, if you do not provide such personal data to the Company, the Company may be unable to perform the contract or proceed with your request to enter into a contract, or the Company may be unable to cooperate or fulfill its legal obligations, and there may be other related impacts on you. 

5. Disclosure of Your Personal Data

5.1 Relevant internal departments within the Company: Only employees or teams with relevant roles and duties, to the extent necessary for the purposes, will be granted access to your personal data. Such persons will be authorized to access your personal data as necessary and appropriate, under the Company’s strictly enforced security measures and procedures.

  5.2 Government authorities with legal authority: such as the Royal Thai Police, the Department of Labour Protection and Welfare, courts, the Department of Special Investigation, or any other authorities with legal power to request access to data for investigation or legal proceedings.

5.3 External service providers: The Company may disclose personal data to relevant service providers to support the Company’s operations, including:

• Software and information technology system service providers
• Security service providers (security companies)
• External auditors and assessors for organizational management
• Advisors, such as legal advisors or technical consultants

5.4 Other third parties: Where necessary for security or legal proceedings, the Company may disclose personal data to other third parties, such as:

• Affiliates
• Customers or business partners (where related to the security of premises or shared property)
• Injured persons or their lawful representatives for the purpose of exercising legal rights

6. Cross-Border Transfer of Personal Data

As a general rule, the Company will not transfer CCTV data to foreign countries, except where it is strictly necessary for cross-border legal proceedings or for the use of cloud storage services that meet adequate personal data protection standards as prescribed by the Personal Data Protection Committee.

  In the event that it is necessary to send or transfer personal data to a foreign country, the Company will comply with the requirements of personal data protection laws and implement appropriate measures to prevent unauthorized or unlawful use or disclosure of personal data.

7. Retention and Retention Period of Your Personal Data

The Company will retain CCTV recordings for a period of 15 to 180 days from the date of recording. The retention period may vary depending on the location, the importance of the area, and the storage capacity of each site. Upon expiry of such period, the system will automatically delete the data by overwriting, except in cases where such data is related to abnormal incidents, complaints, or disputes, for which it is necessary to retain the data for investigation, inquiry, or legal proceedings.

In this regard, the Company will retain your personal data only for as long as necessary to achieve the purposes set out in this Privacy Notice. The Company may retain such data for a longer period where required or permitted by law, such as for compliance with the statute of limitations, which may require retention for a period of up to 10 years.

8. Rights of Data Subjects

The Personal Data Protection Act B.E. 2562 (2019) aims to provide you with greater control over your personal data. You may exercise your rights under the Personal Data Protection Act B.E. 2562 (2019) once the provisions relating to the rights of data subjects come into force, as detailed below:

1. Right to be informed: You have the right to be informed of the purposes of the collection, use, or disclosure of personal data, including clear details and the Cookie Policy.
2. Right to withdraw consent: You may withdraw the consent you have given to the Company at any time (in cases where the Company relies on consent as the legal basis for processing).
3. Right of access: You may request access to and obtain a copy of your personal data, and request the Company to disclose how such data was obtained where you did not give consent, unless the Company has the right to refuse your request under the law or a court order, or where your request may adversely affect the rights and freedoms of others.
4. Right to rectification: You may request correction of inaccurate or incomplete personal data to ensure that such data is accurate, up-to-date, and not misleading.
5. Right to erasure: You may request the Company to delete, destroy, or anonymize your personal data where it is no longer necessary or in accordance with conditions prescribed by law.
6. Right to data portability: You have the right to receive your personal data in a format that is readable or commonly usable by automated tools, and to request that such data be transmitted to another data controller.
7. Right to restriction of processing: You have the right to request restriction of the use of your personal data in any of the following cases:
   
   1. When the Company is in the process of verifying your request for rectification to ensure that your personal data is accurate, complete, and up to date.
   2. Where your personal data has been unlawfully collected, used, or disclosed.
   3. Where your personal data is no longer necessary to be retained for the purposes notified by the Company, but you request the Company to retain such data for the exercise of your legal rights.
   4. When the Company is in the process of proving legitimate grounds for the collection, use, or disclosure of your personal data, or verifying the necessity of such processing for public interest, due to your objection to the collection, use, or disclosure of your personal data.
8. Right to object to processing: You have the right to object to the collection, use, or disclosure of your personal data where such processing is based on legitimate interests or for direct marketing purposes, unless the Company has lawful grounds to refuse your request (for example, where the Company can demonstrate compelling legitimate grounds for the collection, use, or disclosure of your personal data, or for the establishment, compliance, or exercise of legal claims, or for public interest under the Company’s functions).
9. Right to lodge a complaint: You have the right to lodge a complaint with the Personal Data Protection Committee or relevant supervisory authority in the event that you believe that the Company, its employees, or its contractors have violated or failed to comply with the Personal Data Protection Act B.E. 2562 (2019).

9. Personal Data Security Measures

The Company implements appropriate personal data security measures, both technical and organizational, to prevent loss of data or unauthorized access, deletion, destruction, use, alteration, modification, or disclosure of personal data, in accordance with the Company’s Information Security Policy.

In addition, the Company has established a personal data protection policy and communicated it throughout the organization, together with guidelines to ensure the security of the collection, use, or disclosure of personal data, while maintaining confidentiality, integrity, and availability of personal data. The Company also conducts periodic reviews of such policy, including this Privacy Notice, at appropriate intervals.

10. Responsibilities of the Data Controller

The Company has designated only authorized personnel with relevant duties in the collection, use, or disclosure of personal data under this processing activity to have access to your personal data. The Company will ensure that such personnel strictly comply with this Privacy Notice.

11. Changes to the Privacy Notice

The Company will regularly review this Privacy Notice to ensure that it is consistent with applicable practices, laws, and regulations. In the event of any changes to this Privacy Notice, the Company will notify you of such changes together with the updated Privacy Notice through the Company’s website and other appropriate channels. In this regard, the Company recommends that you periodically review this Privacy Notice for any changes.

  Your entry into the premises shall be deemed as your acknowledgment of this Privacy Notice. If you do not agree with the terms of this Notice, please refrain from entering the premises. If you continue to enter the premises after this Notice has been amended and published through the aforementioned channels, you shall be deemed to have acknowledged such changes.

12. Contact Information

If you have any questions or require further information regarding the processing of your personal data or the exercise of your rights under this Privacy Notice, you may contact the Company using the following details:

Personal Data Protection Officer	[email protected]
Contact Address	RICOH (Thailand) Limited., head office (On-Nut), no. 341 On-Nut Road, Prawet, Bangkok 10250 Thailand

13. Governing Law

You acknowledge and agree that this Privacy Notice shall be governed by and construed in accordance with the laws of Thailand, and that the courts of Thailand shall have jurisdiction over any disputes that may arise.


Announced on 10 March B.E.2569 (2026)