NVI collects, uses, and closures your personal data based on PDPA as follows:

1.1 It is necessary for compliance with the legal obligations, NVI is obligated to comply with the National Vaccine Security Act B.E. 2561 (2018).

1.2 It is necessary for performance of a task carried out in the public interest or for the exercising of official authority vested in NVI, which is required to carry out in the public interest with the National Vaccine Security Act B.E. 2561 (2018).

1.3 It is necessary for legitimate interest of NVI or other persons, provided that such interests are not less than the fundamental rights of your personal data. NVI may use personal data for communication of news and information relating to users.

1.4 The data subject has given consent to the processing of personal data.

NVI processes your personal data for the purposes as follows:

2.1 For user authentication to access the system by administrators and authorized personnel who have the right to manage the website.

2.2 For user account management, such as adding, deleting, and modifying data by administrators and authorized personnel who have the right to manage the website.

2.3 For communication, inquiries, news and information updates, data surveys, and other related operations.

2.4 For creating a data record of personnel and experts in the field of vaccines, which will be published on the system.

2.5 For creating a data record of vaccine researchers/grantees, which will be published on the system.

2.6 For surveying and analyzing user satisfaction with the system's usage, which will be utilized to improve system performance.

2.7 For analyzing the statistics of website visits for tracking and improving system performance.

According to the objectives in Section 2, NVI will collect your personal data as follows:

3.1 Data sources and methods of collection, including a list of personal data, are as follows:

Data sources and methods of collection	List of personal data
Collect data directly from you, through a registration form.	Name, Surname, Age, Date of birth, Country of residence, Occupation/Position/Role, organization/Employer, Telephone number, and Email.
Collect data through importing data, using data from a vaccine personnel and expert survey form.	Name, Surname, Education level, Current position, Contact location, Photograph, Email, Phone number, Experience and expertise, Vaccine-related Works
Collect data from the NRIIS system via the API connection.	Name, Surname, Education level, Occupation/position, Affiliated organization, Phone number, Email address, Experiencel Expertise
Collect data through login and visiting or using various sections on the website.	Cookie, Computer traffic data, Application usage, Device ID, Browsing History, and IP Address.

3.2 Purpose of Personal Data Usage

Purpose of Personal Data Usage	List of personal data
For user authentication to access the system by administrators and authorized personnel who have the right to manage the website.	Name, Age, Date of Birth, Country of Residence, Occupation/Position/Role, Organization/Workplace, Phone number, and Email.
For user account management, such as adding, deleting, and modifying data by administrators and authorized personnel who have the right to manage the website	Name, Age, Date of Birth, Country of Residence, Occupation/Position/Role, Organization/Workplace, Phone Number, and Email.
For communication, inquiries, news and information updates, data surveys, and other related operations.	Name, Country, Occupation/Position, Organization, Country, Phone Number, and Email.
For creating a data record of personnel and experts in the field of vaccines, which will be published on the system.	Name, Surname, Education, Level current position, Contact location, Photograph, Email, Phone number, Experience and expertise, and Vaccine-related Works.
For creating a data record of vaccine researchers/grantees, which will be published on the system.	Name, Surname, Education level, Occupation/position, Affiliated organization, Phone number, Email address, Experience/ Expertise
For surveying and analyzing user satisfaction with the system's usage, which will be utilized to improve system performance.	Name, Age, Date of Birth, Country of Residence, Occupation/Position/Role, Organization/Workplace, Phone Number, and Email.
For analyzing the statistics of website visits for tracking and improving system performance.	Cookie, Computer traffic data, Application usage, Device ID, Browsing History, and IP Address.

NVI will collect and use cookies (cookies refer to the files that store website usage data, such as date and time, clicked links, visited pages, and various configuration settings), which are saved on your computer device and/or communication devices that you use, such as notebook, tablet, or smartphone, through web browsers when you visit our website. Cookies will not cause harm to your computer and /or communication devices.

In the following cases, your personal data may be collected to enhance your online service experience by identifying your language preferences and customizing usage data according to your preferences to confirm your unique characteristics and ensure the security of your data.

Furthermore, cookies are used to measure the volume of online service usage and to change content according to your usage behavior in the past and present.

This information will be used to enhance the website to better meet your requirements and for the purpose of ensuring the security of our service delivery and providing users with a positive experience when visiting www.vims.nvi.go.th. You can configure or delete cookies manually through the settings as per your web browser's preferences.

Your rights according to the Personal Data Protection Act B.E. 2562 (2019) are as follows:

5.1 Right of access

You have the right to access and obtain a copy of your personal data held by NVI, including disclosure of the source of the personal data collected without your consent, unless NV is required by law or court order, or accessing and obtaining a copy of your personal would adversely affect the rights and freedoms of others.

5.2 Right to rectification

You have the right to request NVI to rectify any incorrect or incomplete personal data to ensure that it is up to date, complete, and not misleading.

5.3 Right to erasure

You have the right to request NVI to erase, destroy or anonymize your personal data. This right to erasure or destruction of personal data is subject to the conditions specified by law.

5.4 Right to restriction of processing (suspending use of personal data)

You have the right to request NVI to suspend the use of personal data in the following circumstances:

5.4.1 During the period when NVI is verifying and correcting your personal data for accuracy, completeness and up to date, as requested by you.

5.4.2 When your personal data is being used or disclosed without legal authorization.

5.4.3 When your personal data is no longer necessary for the purposes for which it was collected by NVI, unless you request NVI to retain personal data in support of your legal rights.

5.4.4 During the period when NVI is verifying your objection to the use or disclosure of your personal data in accordance with the law.

5.5 Right to object

You have the right to object to the collection, use, or disclosure of your personal data by NVI, unless NVI has lawful grounds to reject your request, such as when NVI can demonstrate that the collection, use, or disclosure of your personal data is necessary for Legitimate grounds, or for the performance of NVI's public duties as permitted by law.

5.6 Right to withdraw consent

In the even that you have given consent to NVI for collection, use or disclosure of personal data, you have the right to withdraw your consent at any time during the period in which your personal data is being retained, unless legal restrictions require to NVI continue retaining your personal data.

5.7 Right to data portability (request, receive, or transfer personal data)

You have the right to request NVI to provide you with your personal data that is available in a format that is readable and commonly used by automated devices or equipment, and that can be used or disclosed automatically. Additionally, you may request NVI to transmit or transfer your personal data in such a format to other data controllers, provided that such a request is in compliance with the conditions specified by law.

In some cases, NVI may transmit or transfer your personal data to foreign countries for the purposes of providing services to you, such as sending personal data to a cloud system or server platform located abroad to support information technology systems located outside of country. This depends on the NVI's services that you use or are involved in as an activity. The NVI has complied with the criteria for protecting personal data that are transferred or transmitted to foreign countries as announced by the Personal Data Protection Committee.

NVI will keep your personal data for as long as necessary for the purposes of data collection and as required by law. Once the necessary period of time has passed and your personal data is no longer necessary for the aforementioned purposes and by law, NVI will delete, destroy or anonymize your personal data. However, in case of legal proceedings, your personal data will be kept until termination of the proceedings, including other necessary action required for achieving such purpose. Then, your personal data will be removed or kept as permitted by law.

If it is not possible to determine the exact retention period, NVI will keep your personal data for a period of 10 years in accordance with the Regulations of the Office of the Prime Minister Concerning Documents Management, B.E. 2526 (1983). Upon the expiration of such retention period, NVI will delete, destroy, or anonymize your personal data that no longer identify the data subject.

NVI may assign or procure the services of a third party (personal data processor) to process personal data on behalf of or in the name of the NVI. Such third party may offer services in various forms such as being a host, receiving outsourcing services, being a cloud computing service/provider, or participating in joint operations and/or other forms of service provision.

When assigning a third party to process personal data, the NVI shall ensure that there is an agreement specifying the rights and responsibilities of the NVI as the controller of personal data and the third party as the personal data processor appointed by the NVI. This agreement shall include the details of the types of personal data assigned by the NVI for processing, the purposes, scope of data processing, and other relevant terms and conditions. The personal data processor shall only process personal data within the scope specified in the agreement and in accordance with the NVI's instructions.

In the event that the personal data processor assigns a service provider (data processor sub-contractor) to process personal data on behalf of or in the name of the personal data processor, NVI shall direct the personal data processor to establish an agreement with the data processor sub-contractor in a format and standard no less than the agreement between the NVI and the personal data processor.

NVI has measures in place to ensure the security of personal data, both in terms of organizational and technical standards that meet international standards and comply with the regulations established by the Personal Data Protection Committee. Access to personal data is restricted to authorized personnel or individuals who have been assigned and have a necessary purpose to use such data, as specified by the data owner. Such individuals must strictly adhere to and implement the NVI's measures for protecting personal data, as well as maintain the confidentiality of any personal data that they become aware of through the course of performing their duties.

In order to ensure the security and confidentiality of your personal information, you must not disclose your password or personal information to unauthorized persons. If you have shared or disclosed your password or personal information to others, or in any case where you are unable to maintain the confidentiality of your personal password or cannot control its use, you will be responsible for any actions that occur under your name or account. Such actions will be deemed as taken by you and you will be liable for any legal consequences as the owner of the account.

NVI may disclose your personal data only when requested by the personal data owner, executor, representative, guardian or legal guardian, by sending a request to the National Vaccine Institute at contact@nvi.go.th or call center 02-580-9729.

In case the personal data owner, executor, representative, guardian or legal guardian objects to the collection, accuracy, or any action, such as the notification to amend the personal data, NVI will record the objection as evidence.

However, NVI may deny the rights under the second paragraph if provided by law or if your personal data is anonymized or cannot identify the individual.

NVI may consider revising, amending, or making changes to the Privacy Notice as it deems appropriate and will inform you through www.vims.nvi.go.th website. NVI recommends that you regularly check for updates to this declaration, especially before disclosing personal information to NVI.

Your use of the products or services provided by NVI under this processing activity will be deemed as acceptance of the terms and conditions of the Privacy Notice. However, please discontinue use if you do not agree with the terms of this declaration and contact NVI to clarify any issues. If you continue to use the products or services after the declaration has been revised and updated through the channels mentioned above, you will be deemed as having acknowledged the changes made.