Privacy Notice for CCTV Cameras

(Privacy Notice for CCTV)
—————————————————————————————

Sripatum University (“the University”) would like to inform you about the University’s Privacy Notice. This Privacy Notice explains how the University will treat your personal data. In order to protect your personal data that the University will collect, use and/or disclose, the University has established this Privacy Notice. The University would like you to read this Privacy Notice to know and understand the University’s objectives in collecting, using and/or disclosing your personal data, as follows:

1. Purpose of collecting, using and/or disclosing personal data

The University aims to provide education to students with knowledge and expertise, respond to needs in line with the national economic and social conditions, and emphasize the missions of higher education institutions in terms of learning, teaching, research, providing academic services to society, and preserving the good arts and culture of the nation. In order to achieve these objectives, the University will collect, use, and/or disclose personal information only as necessary for the University’s operational objectives and under the Personal Data Protection Act B.E. 2562, according to the following objectives and bases:

(1) Contract basis

It is necessary for you to provide personal data to the University when you use the service or contact about the service offer or enter into a contract with the University so that the University can process such data in relation to the action requested before entering into a contract or performing the contract or so that the University can communicate or follow up and inform you about the performance of the contract.

(2) Consent basis

Where necessary, when you have given consent to the University, the University may use your personal data for processing for designing or developing education or services, for presenting marketing activities related to education, or for management under the University’s operations.

(3) Legitimate Interest

In necessary cases, the University may use your personal data for processing for management and preparation of necessary reports within the University, system maintenance to maintain standards or service development, risk management within the University, internal control and audit, which are necessary for the legitimate interests of the University.

(4) Archival, research or statistical bases

The University may process your personal data to achieve the purposes of compiling historical documents or archives for public interest or for studies, research, or statistics, for which appropriate measures have been taken.

(5) Vital Interest

In necessary cases, the University may process your personal data for the purpose of eliminating a danger to the life, health or safety of you or another person.

(6) Public Task

In necessary cases, the University may use your personal data for processing to perform duties in the public interest or to exercise state powers assigned to the University.

(7) Legal Obligation

In the event of necessity, the University may use your personal data for data processing to comply with laws currently in effect and those that may be amended or supplemented in the future.

Personal data that the University has collected, used and/or disclosed your personal data in accordance with the purpose of using the service, together with the lawful basis of processing of personal data in each activity as follows:

objective	Processing base Legal personal data types
1) To prevent danger to life, body, health of students, employees and those who come into contact with the university, including your property.	1.1) Essential to life: Necessary to protect the essential interests of you or another person, including your property and that of the University. 1.2) Legitimate Interest: For the legitimate interests of the University, to protect your safety or that of others, including your property and that of the University.
2) For the benefit of maintaining the safety of students, employees and those who come into contact with the university, including your property and that of the university, and to prevent any danger that may occur to those using the building or cause damage to the university.	2.1) Essential to life: Necessary to protect the essential interests of you or another person, including your property and that of the University. 2.2) Legitimate Interest: For the legitimate interests of the University, to protect your safety or that of others, including your property and that of the University.
3) To support government agencies or law enforcement agencies in investigating, obstructing, tracking, preventing and detecting misconduct, crimes or violations of the law.	3.1) Legal basis: Necessary for compliance with any provision of law or order of any government agency or law enforcement agency.

The University may use more than one legitimate data processing base for processing your personal data, depending on the purposes for which the University uses your personal data.

2. Personal data that the university will process

Personal information: Still images, motion pictures, audio, and images of property such as vehicles that enter the controlled areas both inside and around the University premises.

However, if the data owner does not provide personal data to the university to comply with the law or contract, the contract may not be fully performed and may result in inconvenience or non-compliance with this condition.

3. Sources of personal data

The University will collect, use and/or disclose your personal data based on the sources of CCTV.

The university will install CCTV cameras in easily visible areas, excluding areas that may unreasonably violate your fundamental rights, such as restrooms or rest areas for workers. CCTV cameras will operate 24 hours a day, every day, and the university will install signs at the entrances and exits of the university to inform you that CCTV cameras are installed on the university premises.

4. Disclosure or transfer of personal data

4.1 Disclosure, transmission or sharing of personal information

The University may disclose, transmit or share your personal information with external parties and will use it for the purposes set out in this Privacy Notice as follows:

(1) Regulatory agencies, such as the Personal Data Protection Commission.

(2) Any government agency or organization that has the power and duty as prescribed by law to support or assist in the investigation, inquiry or prosecution of various cases, such as the police office, the public prosecutor’s office, the court, etc.

(3) External agencies, such as agencies involved in preventing or suppressing dangers to the life, body, health, and property of you or other persons.

4.2 Disclosure, sending or transferring personal data abroad

In the event that the University discloses, sends or transfers your personal data abroad, the University will transfer or transfer to the destination country, international organization or overseas recipient that has adequate measures to protect personal data and the University may request your consent for the transfer of personal data abroad as required by law.

Third parties who receive your personal data from the University must not use or disclose that data for any purpose other than those notified to the University.

5. Period for collecting, using and/or disclosing personal information

The University may collect, use and/or disclose your personal information only as necessary to fulfill the purposes set out in this Privacy Notice, except that the University may continue to retain your personal information if it deems it necessary or a longer retention period is required by law.

The University will delete or destroy your personal data when it is no longer necessary or when the period for that purpose has expired.

6. Rights as a data subject

You have the right to take the following actions to the extent permitted by law:

(1) The right to request the withdrawal of consent.

If you have given consent for the University to collect, use and/or disclose your personal data, you have the right to withdraw your consent at any time during the period that your personal data is with the University.

(2) Right to access personal data

You have the right to request access to and a copy of your personal data held by the University or request that the University disclose the source of such personal data to which you have not given consent.

(3) The right to request correction of personal data.

You have the right to request the University to correct or add incomplete personal data.

(4) The right to request deletion or destruction of personal data.

You have the right to request that the University delete or destroy your personal data as required by law.

(5) The right to request suspension of use of personal data.

You have the right to request that the University suspend the use of your personal data as required by law.

(6) The right to request or request the sending or transfer of your personal data.

You have the right to request your personal data where the University can make such data in a universally understandable format by means of automated tools or devices and can use or disclose personal data by automated means, including the right to request that the University send or transfer personal data in such format to another data controller or to request that the University send or transfer personal data directly to another data controller, unless this is not possible due to technical reasons.

(7) The right to object to the processing of personal data.

You have the right to object to the collection, use and/or disclosure of your personal data at any time, as required by law.

(8) Right to lodge a complaint.

You have the right to lodge a complaint with the relevant legal authorities if you believe that the University’s collection, use and/or disclosure of your personal data is in violation of or does not comply with relevant laws.

7. Privacy Notice Changes

The University may update, change or amend this Privacy Notice to comply with University operations and applicable laws, and will post a notification on the University website at www.spu.ac.th

8. Information about the personal data controller and data protection officer

If you have any questions about personal data protection, you can contact us as follows:

(1) Personal Data Controller: Sripathum University, No. 2410/2 Phahonyothin Road, Senanikhom Subdistrict, Chatuchak District, Bangkok.

(2) Personal Data Protection Officer: Any person or agency of the University responsible for protecting personal data may be contacted at telephone number 0 2561 1111, 0 2561 2222 or fax 0 2561 1720 or E-mail: DPO@www2.spu.ac.th.