Introduction

Pornmana Co., Ltd. welcomes all users to the sanpaulo.co.th website, which is under the company’s management, and has established this “Privacy Policy” to protect the personal data of users who access the website’s services. The company has a duty to maintain trustworthiness and therefore takes the following actions to protect users’ personal information from third parties:

• The company maintains the security of personal data in accordance with established standards.
• The dissemination or sharing of information will be strictly in accordance with legal requirements.
• The company will only publish personal information upon receiving user consent.

This privacy policy applies to sanpaulo.co.th, the sanpaulo.co.th application, and other platforms under the sanpaulo.co.th domain name. If there are any changes to the privacy policy, the company will notify users immediately.

Data Collection

• To ensure the convenient provision of services for all users accessing the sanpaulo.co.th website, Digital Rights Management (DRM) encryption is utilized.
• To receive privileges after subscribing, users must create an account with Thai World Media Co., Ltd.
• Users logging in via social media platforms (such as Facebook, Line, Google, Apple ID) must agree to the terms and privacy policy.
• After registration, users can provide additional information, such as their first name, last name, email, or phone number, to allow the company to curate the most appropriate information for them.
• To improve service quality, the company needs to collect additional information, including IP Address, Browser, Domain name, visit time, services used prior to visiting sanpaulo.co.th, viewed content, and user experience on the website and its affiliated sites.
• The company recommends that users review the privacy policy; if a user finds the conditions unsuitable and does not wish to accept them, they can cancel their membership immediately.

Use of Personal Data

• sanpaulo.co.th guarantees that collected personal information will not be disclosed to third parties under any circumstances unless consent is explicitly obtained from the user.
• In the event that sanpaulo.co.th hires other agencies to process user data (e.g., for statistical analysis or operational activities), those assigned entities are required to maintain strict data confidentiality and security.
• It is strictly forbidden to disseminate personal information outside of the activities related to sanpaulo.co.th.

Right to Control Personal Data

To ensure the security and confidentiality of personal data, sanpaulo.co.th establishes rules and access rights, providing a secure communication channel using Secure Socket Layer (SSL) Protocol encryption for data transmission.

Use of Cookies

Cookies are data sent by sanpaulo.co.th to the user’s browser. Once cookies are installed on the user’s system, they allow the website to remember user data until the user closes the browser, deletes the cookies, or disables them.

Updating the Privacy Policy

sanpaulo.co.th may update or modify this privacy policy without prior notice to ensure optimal suitability and service efficiency. Users are advised to read the privacy policy every time they visit the website. If you have any questions, suggestions, or feedback regarding this policy, please contact us via the channels below:

• Telephone: 032-532576
• Fax: 032-532585
• Email: dpo@sanpaulo.co.th

Cookie Policy

During your navigation on the sanpaulo.co.th website, data related to your browsing will be saved in the form of cookies. This Cookie Policy explains what cookies are, how they work, their purpose, and how to delete them for your privacy. By browsing this website, you grant us permission to use cookies in accordance with the details below:

What are Cookies?

Cookies are small files stored on your computer or communication device via your chosen web browser while you are visiting our website.

Benefits of Cookies

• We use cookies to store your site visit identity, which makes it easier for us to remember your usage characteristics.
• This information is used to tailor our website to your needs, providing convenience and speed during your visit.
• In some areas, we require third parties to perform these operations, which may involve using IP Addresses and cookies to analyze, link, and process data for marketing purposes.

Types of Cookies Used

We use four types of cookies on our website, none of which can identify your personal identity:

• Strictly Necessary Cookies: These are essential for accessing information and using all parts of our website. They are deleted after your browsing session.
• Analytical/Performance Cookies: These help us measure performance by evaluating the number of pages visited and visitor characteristics. The data analyzes behavioral patterns to improve the website’s responsiveness. This data is anonymous, does not collect personal specifics (like names or emails), and is used solely for statistical purposes.
• Functionality Cookies: These remember the choices you made during your visit, applying them upon your return so you do not have to re-select them. This data is anonymous, does not collect personal specifics, and is used solely for statistical purposes.
• Targeting/Advertising Cookies: These remember your visits and interests to adapt the website’s interface and marketing policies to suit your needs.

Changes to Our Policy

This Cookie Policy may be updated occasionally to comply with legal regulations. We recommend checking it regularly to ensure you understand any changes.

Contact Channels

You can contact the Data Controller for inquiries or to exercise your rights regarding personal data at:

• Telephone: 032-532576
• Fax: 032-532585
• Email: dpo@sanpaulo.co.th

CCTV Privacy Policy

Pornmana Co., Ltd., operating as San Paulo Hua Hin Hospital (the “Hospital”), installs and utilizes Closed-Circuit Television (CCTV) equipment to monitor the areas inside and around its buildings. This is to protect the life, health, and property of patients, visitors, personnel, contractors, employees, and any individuals entering the monitored areas (collectively referred to as “You”).

As a Data Controller, the Hospital is legally obligated to inform you through this document about the reasons and methods used to collect, use, or disclose your personal data, as well as your rights as a data subject. The Hospital confirms its compliance with personal data protection laws as detailed in this “CCTV Privacy Policy.”

Data Collection Methods and Stored Personal Data

• The hospital collects still images, video footage, and images of objects or other identifiable data when you enter monitored areas.
• This includes the recording of your images, sounds, property, vehicles, license plates, and other identifiable data.
• Biometric data, such as Face Scan/Face Recognition and voice recognition data, may also be collected.

Purposes and Legal Bases for Data Processing

The hospital relies on the following legal bases: (1) Legal Obligation, (2) Legitimate Interest of the company or third parties (balanced with your fundamental rights), (3) Vital Interest (preventing danger to life, body, or health), and (4) Consent (for sensitive data) to collect, use, or disclose personal data for the following purposes:

• To inspect and secure premises, assess security risks, record facility access, manage access card exchanges, and record video inside and around the building.
• To ensure the safety of employees, service users, and third parties, and protect company assets from unauthorized access to restricted areas.
• To protect your health, safety, and property.
• To protect buildings, facilities, and property from damage, disruption, vandalism, and other crimes.
• To support law enforcement in deterring, preventing, and detecting crimes, including prosecution.
• To comply with legal requests from authorized government agencies or to serve as evidence for crimes or accidents occurring on the premises.
• To efficiently assist in dispute resolution processes.
• To assist in investigations or proceedings related to whistleblowing.
• To establish or defend against legal claims, including civil and labor cases.
• To perform any other acts aligning with the purposes of installing CCTV as specified in this policy.
• If the company needs to process your data beyond these stated purposes, changes will be announced on www.sanpaulo.co.th.

Disclosure of Personal Data

The company will not disclose your personal data collected via CCTV to third parties. However, the company may disclose it to authorized government agencies upon request, such as the Royal Thai Police, the Office of the Attorney General, or the Courts.

Data Retention Period and Your Rights

• The hospital will retain your personal data only for as long as necessary to fulfill the stated purposes, as required by law, according to the statute of limitations, or for establishing legal claims.
• Upon the expiration of the retention period, the hospital will delete, destroy, or anonymize the data.
• You can exercise your rights regarding your personal data under the Personal Data Protection Act (PDPA).

Contact Channels

If you have questions or wish to exercise your rights regarding your personal data, you can contact the Data Controller at:

• Telephone: 032-532576
• Fax: 032-532585
• Email: dpo@sanpaulo.co.th