6. Your Rights as a Data Subject

• 1. Right to Withdraw Consent

  This refers to the right of data subjects to withdraw their consent for the collection, use, or disclosure of their personal data at any time. The process of withdrawing consent must be simple and straightforward, similar to the process of giving consent. The withdrawal of consent will not affect the processing of personal data that was previously carried out based on the consent provided before its withdrawal.

• 2. Right to Access and Obtain Copies of Personal Data

  Data subjects have the right to access their personal data and request a copy of the personal data concerning them. The information that can be requested includes the following:

  • Purposes of data processing
  • Types of personal data
  • Data controller details
  • Retention periods or criteria for determining them
  • Rights to rectify, delete, restrict, or object to data processing
  • Rights to file complaints with the data controller
  • Sources of personal data, if obtained from third parties

• 3. Right to Data Portability

  Data subjects have the right to request that the personal data controller transfer their personal data to another personal data controller, provided it meets the conditions specified by law. Such data must be in an electronic format that is readable or usable in electronic systems and must consist of data that the data subject has provided to the original personal data controller. This right is applicable only if it does not infringe on the rights and freedoms of others.

• 4. Right to Object to the Collection, Use, or Disclosure of Personal Data

  Data subjects have the right to object to the processing of their personal data in certain cases as stipulated under Section 32 of the Personal Data Protection Act, B.E. 2562 (2019). The data subject may exercise this right at any time under the following circumstances:

  • Collection, use, or disclosure of personal data for the legitimate interests of the data controller or others
  • Collection, use, or disclosure of personal data for direct marketing
  • Collection, use, or disclosure of personal data for scientific, historical, or statistical research purposes

  If a data subject exercises their right to object, the data controller must immediately cease the collection, use, or disclosure of the personal data in question, except in cases where the data controller can demonstrate that there are compelling legitimate grounds that outweigh the rights of the data subject or that the processing is necessary for the establishment, exercise, or defense of legal claims.

• 5. Right to Request Deletion or Destruction of Personal Data

  Data subjects have the right to request the deletion or destruction of their personal data. Such a request may be made under the following circumstances:

  • The personal data is no longer necessary for the purposes for which it was collected or processed.
  • The data subject withdraws their consent for the processing of personal data, and no other legal basis for processing exists.
  • The data subject objects to processing based on public interest or legitimate interest grounds, and the data controller cannot demonstrate that such processing is necessary for performing tasks in the public interest or that the legitimate interest overrides the rights and freedoms of the data subject. This does not apply to processing carried out for establishing, complying with, exercising, or defending legal claims, or for legal compliance.
  • The data subject objects to processing for direct marketing purposes.
  • The processing of personal data is unlawful. However, the data controller may refuse a deletion request if the continued retention, use, or disclosure of the data is demonstrably necessary for research or statistical purposes, or for the establishment, implementation, exercise, or defense of legal claims, or to comply with legal obligations. In such cases, data retention is justified, and rejecting the request is permissible based on research or statistical grounds.

• 6. Right to Restrict Processing

  Data subjects have the right to request the restriction of the processing of their personal data. Situations where this right may be exercised include:

  • The data subject disputes the accuracy of the personal data and the accuracy is under verification.
  • The processing is unlawful, and the data subject requests restriction instead of deletion.
  • The data controller no longer needs the personal data for processing, but the data subject requires the data controller to retain it for the establishment, exercise, or defense of their legal claims.
  • The data subject has objected to processing pending verification of whether the legitimate grounds of the data controller override the data subject’s rights.

• 7. Right to Rectification

  The data subject has the right to request the data controller to correct, update, or complete their personal data to ensure its accuracy and prevent misunderstandings or inaccuracies.

  To exercise their rights, data subjects can contact the Data Protection Officer (DPO) to request access to their data, rectify data, withdraw consent, request deletion, or exercise other related rights as prescribed by law.

Grounds for Denial of Data Subject Requests

Yamaha reserves the right to deny a data subject’s request under the following circumstances:

• When the denial is required by law or a court order.
• When granting access or providing a copy of the personal data would adversely affect the rights or freedoms of others, such as disclosing trade secrets or proprietary information of third parties.

If a data subject submits a request deemed excessive or unnecessary, a reasonable fee may be charged for processing such requests. The data controller may also deny the request and must record the reasons for the denial.

Note: Personal data collected before the enforcement of the Personal Data Protection Act B.E. 2562 (2019) may still be used for the purposes originally communicated. However, if the data subject objects to the use of such data for its original purpose, they may exercise their right to object as provided by law.

7. Security Measures

Yamaha, as the data controller, has implemented appropriate security measures to safeguard personal data from loss, unauthorized access, use, alteration, or disclosure. These measures encompass the following three main areas:

• Organizational Measures
• Technical Measures
• Physical Measures

Yamaha conducts risk assessments and considers the nature of the personal data collected, used, or disclosed. This includes access control, user rights management, and audit trails. The organization also promotes awareness among employees regarding the importance of data security and continuously updates its security measures to align with technological advancements and in response to any data breaches.

8. Contacting the Company

If you have any concerns or suspect a violation regarding the collection, use, or disclosure of personal data, or if you wish to file a complaint or exercise your rights under this policy or the Personal Data Protection Act B.E. 2562 (2019), you may contact Yamaha’s Data Protection Officer through the contact information provided below: