The Board of Directors of SF Corporation Public Company Limited (the “Company”), as the employer to the relevant vendor, issues this Notification regarding Vendor’s Privacy Notice (the “Notification”) in order to notify the relevant vendor who is participating in the procurement process or who is registering to be the authorized third party service provider for the Company (altogether referred to as the “Vendor” of the terms and conditions of the Company to process the personal identifiable information (“PIIs”) of the Vendor as follows:


Under this Notification, the Vendor shall include the suppliers, service providers, temporary employees or any vendors being engaged under the procurement agreement with the Company.


Clause 1 This Notification is called the “Company’s Notification regarding Vendor’s Privacy Policy” and shall be fully effective from the date of announcement onwards.

Clause 2 Any notification, regulations, instruction, or other operating manual of the Company that have been issued and implemented prior to the effectiveness of this Notification shall fully remain valid and effective that are not conflicting with the terms and conditions defined under this Notification. In case of any conflicting terms and conditions, the terms and conditions under this Notification shall prevail without affecting the actions undertaken or executed prior to the effective of this Notification, except defined.

Clause 3 The Company may amend this Notification from time to time in order to assure the compliance of this Notification with the relevant laws and regulations as well as the change in the arrangement of procurement or registration and agreement that the Company may have with the Vendor; provided that the Company shall notify the Vendor of those amendments and those amendments shall become effective upon announcement.

Clause 4 The Vendor’s PII that shall be processed by the Company for the purposes as defined in this Notification include (1) direct PII, including full name, identification number and copy of identification card, contact information, and other qualifications relating to the Vendor that have been given in the vendor registration form or the vendor agreement; (2) payment information, including bank account and payment history; and (3) working information as well as the evaluation result of the Vendor.

Clause 5 Based on the legal basis of (1) the performance of the contractual obligations of the Company as the employer under the agreement entered into between the Company and the Vendor; (2) the performance of the legal obligations that the Company may have under the relevant laws and regulations, accounting and tax law in particular; and (3) the protection of the legitimate interest of the Company, the Company would need to process the Vendor’s PIIs in order to contact and coordinate with the Vendor in the performance of the Vendor’s duties and exercise rights under the agreement; to assess the capacity and efficiency of each Vendor, including to enforce the sanction on the Vendor in case of any violation of any terms and conditions of the agreement; and to protect the Company’s legitimate interest and rights for the legal proceedings or any fraud in the Company’s system.

Clause 6 The Company would need to retain and store the Vendor’s PII throughout the period of time that the Company and the Vendor may have any outstanding rights and obligations under the relevant agreement. In addition, for the specific purpose that the Company may need to protect their legitimate rights under the relevant agreement between the Company and the Vendor, the Company reserves the right to store the Vendor’s PIIs for the period of time that would be necessary for the Company to take such action efficiently, being the period of time of 3 years after the completion of all the relevant agreement between the Company and the Vendor. Also, in case any of the Vendor’s PII would need to be processed under the Company’s legal obligations, the Company shall store the Vendor’s PII for the same period prescribed under the applicable laws.

Clause 7 For the purpose of performing the Company’s duties, the Company shall be required to disclose the Vendor’s PII to the following parties: (1) to the third party service provides that the Company may engage under any agreement to provide support to the Company; provided that the Company shall only disclose PII on the need to know basis pursuant to the data processing agreement entered into between the Company and the third party service providers; and (2) to the relevant government authorities that the Company shall be obliged under the applicable laws or under the instructions or judgment made to the relevant government authorities; provided that the disclosure shall only be on the necessity.

Clause 8 The Company undertakes that the Company shall use the most appropriate security measures to prevent unauthorized access, amendment or disclosure of the PII in order to maintain the confidentiality and information security of the PIIs; provided that the Company commits to review those measures on the regular basis to be in strict compliance with the applicable laws.


Clause 9 The Company respects the following rights relating to the PII of the Vendor as defined under the applicable laws:

1. Right to access; to request for the copy; and to rectify or update their own PII

2. Right to request for data portability of the PII that the Company has processed in the readable forms by the tools or automatic mechanics to other data controllers.

3. Right to object to the PII process being undertaken.

4. Right to request the erasure or de-identification of any PII that does not have any necessary basis to process or after the consent withdrawal.

5. Right to request for the suspension of PII process in case that request for erasure is being exercised or when it is unnecessary to process such PII;

6. Right to withdraw consent that has been given.

The Vendor can contact the Company in order to make the request to exercise any defined rights by contacting number 02-0487111 Ext. 2125. or email lg@sfcinema.com and the Company will consider and notify the Vendor of the Company’s determination within the reasonable period as defined under the relevant laws.