โลโก้ EECO Eastern Economic Corridor Office
โลโก้ EEC OSS บริการ One Stop Service
โลโก้ EECO Eastern Economic Corridor Office
โลโก้ EEC OSS บริการ One Stop Service

Personal Data Protection Policy
(PDPA Policy)

Personal Data Protection Policy Eastern Economic Corridor Office (EECO)

1. Introduction

The Eastern Economic Corridor Office (“EECO”) recognizes the importance of protecting personal data and respecting the privacy rights of data subjects. To ensure that the collection, use and disclosure of personal data are safeguarded in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and other relevant applicable laws and regulations, EECO has established this Personal Data Protection Policy (“Policy”). This Policy is intended to assure you that EECO oversees the collection, use or disclosure (collectively referred to as “processing”) of personal data and puts in place measures to safeguard and protect personal data processed by EECO, its personnel and relevant persons acting for or on behalf of EECO, in strict compliance with the requirements set out in this Policy.

2. Scope and Objectives of the Policy

The main objectives of this Policy are:

  1. To inform data subjects of EECO’s practices for protecting personal data under its control and to ensure that appropriate safeguards and protection measures are in place in accordance with the PDPA.
  2. To provide a framework for establishing rules, procedures and guidelines, and preparing relevant and necessary documents, to ensure that each category of personal data collected is protected and kept secure.


This Policy covers the protection of all categories of personal data of all natural persons that EECO collects, uses or discloses, whether in its capacity as a data controller or a data processor under the PDPA.

In addition to this Policy, EECO may issue privacy notices for its services or other activities involving the processing of personal data. These notices will inform data subjects of the personal data processed, the purposes of processing, the retention periods and their rights in relation to the particular service or activity. In the event of any conflict between the substantive provisions of a privacy notice and this Policy, the provisions of the privacy notice applicable to that service or activity shall prevail.

3. Definitions

“EECO” means the Eastern Economic Corridor Office of Thailand.

“Personal Data” means any information relating to a person that enables the identification of that person, whether directly or indirectly, but excludes information relating specifically to deceased persons.

“Sensitive Personal Data” means personal data specified under Section 26 of the PDPA, such as racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data that may affect the Data Subject in a similar manner, as prescribed by the Personal Data Protection Committee.

“Processing of Personal Data” means the collection, use or disclosure of Personal Data by EECO, whether in its capacity as a Data Controller or a Data Processor under the PDPA.

“Data Subject” means an individual to whom the Personal Data collected, used or disclosed by EECO relates.

“Data Controller” means a person or juristic person having the power and duties to make decisions regarding the collection, use or disclosure of Personal Data.

“Data Processor” means a person or juristic person who carries out activities relating to the collection, use or disclosure of Personal Data pursuant to the instructions given by or on behalf of a Data Controller, where that person or juristic person is not the Data Controller.

4. Categories of Personal Data Collected, Used or Disclosed

EECO shall collect, use or disclose Personal Data by lawful and fair means, only to the extent necessary and within the scope permitted under the PDPA, solely for carrying out activities within EECO’s objectives. EECO shall ensure that Data Subjects are informed and that their consent is obtained in writing or by electronic means in accordance with the requirements of the PDPA, unless the collection of Personal Data falls within an exception prescribed under the PDPA, as applicable.

4.1 Categories of Personal Data Collected

The categories of Personal Data that EECO may collect depend on the nature of the activities, the locations and the methods of collection, and may include Personal Data relating to the following groups of individuals:

  1. Members of the Eastern Economic Corridor Policy Committee, and members of committees, subcommittees or working groups under the Eastern Economic Corridor Policy Committee or EECO.
  2. The Secretary-General, Deputy Secretaries-General, Assistant Secretaries-General, Special Advisers, Special Experts, or persons holding positions with other titles at the same or equivalent level within EECO.
  3. EECO’s personnel, staff members and employees.
  4. Business operators, investors or persons entering juristic acts or contracts with EECO.
  5. Persons contacting and using the EEC One Stop Service (EEC OSS).
  6. Data Subjects associated with network partners.
  7. Data Subjects who are external parties.
  8. Officials of government departments and state agencies involved in EECO’s operations.
  9. Members of the general public who contact EECO in connection with any activities.


The categories of Personal Data that EECO may collect include the following:

Personal Data categoryDetails and examples
Personal details
  • Title, first name, middle name and surname.
  • Gender, age, date of birth and place of birth.
  • Marital status, family status, number of family members and number of children.
  • Information about related persons, such as parents, beneficiaries of welfare benefits, emergency contacts and referees.
  • Nationality.
  • Signature.
  • Military service status.
  • Information contained in documents issued by government authorities, such as copies of national identification cards, passports, visas, work permits, house registration certificates, name change certificates, driving licenses and professional licenses, and military documents.
Contact information
  • Address as stated in government-issued documents and current residential address.
  • Telephone number and email address.
  • Account names used for electronic communications or social media, such as LINE IDs and Facebook account IDs.
Employment and education information
  • Organization, affiliation, position and location.
  • Employment details, including employment and educational history, such as type of employment, occupation, rank, position, expertise, license status, employment history, salary information, evaluation results and educational institution.
Financial information
  • Bank account details.
  • Personal income tax information.
  • Salary, special remuneration and position allowance.
Technical and information technology data
  • Technical data obtained through use of EECO’s website or applications.
  • Information system usage and access data, and computer traffic data (log files).
  • IP addresses.
  • Cookie identifiers (Cookie IDs).
Information relating to EECO’s functions
  • Information relating to EECO’s operations under the Eastern Economic Corridor Act B.E. 2561 (2018), such as the development of model areas through systematic economic, social and environmental development; the accumulation and application of modern technology to generate income and improve quality of life in society; proactive and integrated operations through close cooperation among the public sector, the private sector and the public; the development of efficient and systematically interconnected infrastructure and public utilities; appropriate land use; and the development of modern cities that meet international standards.
  • Audio recordings, photographs, video recordings and information relating to participation in activities organized by EECO.
Security-related information
  • Photographs.
  • Information concerning detected suspicious or unusual activities, CCTV images or footage, and video recordings.
Sensitive Personal Data

Sensitive Personal Data specified under Section 26 of the PDPA, such as:

  • Racial or ethnic origin.
  • Political opinions.
  • Cult, religious or philosophical beliefs.
  • Sexual behavior.
  • Criminal records.
  • Health data and disability.
  • Trade union information.
  • Genetic data and biometric data.

4.2 Sources of Personal Data

EECO shall collect or obtain various categories of Personal Data from the following sources:

  1. Personal Data collected directly from Data Subjects when they contact EECO or engage in activities through its service channels, such as applications for services, registration, signing contracts, job applications, complaints, reports of service disruptions or enquiries concerning services within EECO’s powers and duties.
  2. Data collected when Data Subjects access EECO’s website or use services provided under contracts or pursuant to EECO’s powers and duties, such as through monitoring the use of EECO’s website or services using cookies, or through software on Data Subjects’ devices.
  3. Personal Data collected from sources other than Data Subjects where EECO has statutory authority or duties, or where the Data Subjects have consented to disclosure to EECO. Examples include linking the digital services of government agencies to provide integrated public-interest services to the Data Subjects themselves, and circumstances where the provision of contractual services requires the exchange of Personal Data with contracting organizations.


This also includes cases where a person provides EECO with the Personal Data of an external party. The person providing such data is responsible for informing that party of the details of this Policy or the privacy notice for the relevant service or activity, together with the terms and conditions of service, if any, and obtaining that party’s consent where consent is required for disclosure to EECO.

Where EECO needs to collect Personal Data for the performance of a contract, compliance with statutory duties or entry into a contract, a Data Subject’s refusal to provide the requested data necessary for EECO’s services may result in EECO being unable to enter into contracts or commitments, provide welfare benefits, supply or receive goods or services in its dealings with the Data Subject, carry out the Data Subject’s requests, or fulfil contractual duties or applicable terms and conditions.

5. Purposes of Collecting and Processing Personal Data

EECO has duties and powers under the Eastern Economic Corridor Act B.E. 2561 (2018) and other relevant laws. EECO shall collect your Personal Data for various purposes, depending on the nature of your relationship with EECO or the activities in connection with which you use its services.

  • To take the steps necessary to fulfil the public-interest tasks entrusted to EECO or to exercise the statutory powers vested in EECO for the performance of its functions.
  • To enable access to EEC OSS services, including applications and registration for user accounts.
  • To carry out EECO’s transactions.
  • To supervise, operate, monitor, inspect and manage activities for facilitation purposes.
  • To maintain and update data and documents relating to Data Subjects.
  • To compile a database of business operators and investors and facilitate communications.
  • To maintain records of Personal Data processing as required by law.
  • To analyze data and resolve issues relating to EECO’s services.
  • To publicize activities, news and information, and invite participation in EECO’s activities.
  • To take the steps necessary for internal organizational administration, including recruitment, selection of committee members or persons holding various positions, and assessment of qualifications.
  • To prevent, detect, avoid and investigate fraud, security breaches, or prohibited or unlawful acts that may cause harm to EECO and Data Subjects.
  • To confirm and verify identity and check information when persons apply for EECO’s services, contact EECO to use its services or exercise their statutory rights.
  • To send notifications, confirm instructions, communicate and provide news and information.
  • To prepare and deliver relevant and necessary documents or information.
  • To verify registration and coordinate participation in EECO’s events and activities.
  • To take steps necessary for the legitimate interests of EECO or other persons or juristic persons connected with EECO’s operations.

EECO shall collect, use or disclose Personal Data for the purposes of its collection and processing activities in accordance with the following criteria:


1. Consent of the Data Subject.

2. Where consent has not been obtained from the Data Subject, EECO may collect Personal Data under the following exceptions:

  1. To achieve purposes relating to the preparation of historical documents or archives for the public interest, or research or statistics, with appropriate safeguards in place to protect the rights and freedoms of Data Subjects.
  2. Where necessary for the performance of a task carried out in the public interest by EECO.
  3. To prevent or suppress a danger to the life, body or health of the Data Subject.
  4. Where necessary for the performance of a contract to which the Data Subject is a party, or to take steps at the Data Subject’s request.
  5. Where necessary for the legitimate interests of EECO, except where those interests are overridden by the Data Subject’s fundamental rights in their Personal Data.
  6. For EECO’s compliance with the law.


Where EECO needs to collect your Personal Data for the performance of a contract, compliance with statutory duties or entry into a contract, a refusal to provide the data or an objection to processing for the purposes of the activity may prevent EECO from carrying out the requested actions or providing the requested services, in whole or in part.

6. Personal Data Protection Principles

EECO shall observe the following Personal Data protection principles when collecting, using or disclosing Personal Data:

  1. Lawfulness, Fairness and Transparency: Personal Data shall be processed on a legal basis, and notice shall be given of the purposes of processing, the Personal Data collected and the retention periods.
  2. Purpose Limitation: Personal Data shall not be processed for purposes different from those previously notified, unless the new purposes have been notified and the Data Subject’s consent has been obtained, or such processing is permitted by law.
  3. Data Minimization: Personal Data shall be processed only to the extent necessary for lawful purposes.
  4. Accuracy: Personal Data undergoing processing shall be complete, accurate, up to date and not misleading.
  5. Storage Limitation: Retention periods shall be specified for Personal Data undergoing processing. Personal Data shall be erased or destroyed when the retention period expires or when retention exceeds what is necessary for the purposes notified to the Data Subject, except as otherwise prescribed by law.
  6. Integrity and Confidentiality: Appropriate security measures shall be implemented for the processing of Personal Data to prevent its loss or unauthorized or unlawful access, use, alteration, modification or disclosure.
  7. Practices and staff duties and responsibilities for Personal Data protection shall be established in accordance with this Policy, personal data protection law and other relevant policies.
  8. EECO shall support and promote sufficient knowledge and understanding of Personal Data protection among its personnel and provide training to enable them to comply correctly and effectively with Personal Data protection policies and personal data protection law.
  9. Service users and persons contacting EECO shall be informed, through clear privacy notices and cookie notices, of why EECO processes their data and with whom EECO shares or discloses such data.
  10. Where the Data Subject’s consent is required, the request for consent shall be explicit, use clear wording, and be presented in an easily accessible and understandable form or statement using plain language.
  11. Procedures and responsible persons shall be designated for examinations, investigations, inquiries and internal reporting in the event of a Personal Data breach.
  12. A Personal Data processing agreement or contract shall be put in place where EECO engages or assigns an external party to process Personal Data for EECO.
  13. Records of Personal Data processing activities shall be maintained in accordance with Section 39 of the PDPA to enable inspection by Data Subjects and the Office of the Personal Data Protection Committee. Such records shall include, for example, the Personal Data collected and information about the Data Controller. The records shall be reviewed and checked at least once a year.

7. Use or Disclosure of Personal Data

EECO shall not use Personal Data or disclose it to other persons without the Data Subject’s consent and shall disclose it for the purposes notified to the Data Subject before or at the time of collection, except where consent is not required under the PDPA or where disclosure is requested pursuant to statutory authority.

Where a Data Controller sends or transfers Personal Data to a foreign country, the destination country receiving the Personal Data shall have adequate Personal Data protection standards, except where:

  1. The sending or transfer is required for compliance with the law.
  2. The Data Subject has given consent after being informed of the inadequate Personal Data protection measures in the destination country.


Where Personal Data is transferred abroad, EECO shall put in place control measures to ensure that the destination country or international organization receiving the Personal Data develops adequate Personal Data protection standards. EECO shall inform Data Subjects of the risks before the transfer.

EECO may also assign or engage third parties (Data Processors) to process Personal Data for or on behalf of EECO. Such third parties may provide hosting, outsourcing, cloud computing or other contracted services. Where EECO assigns a third party to process Personal Data as a Data Processor, EECO shall put in place an agreement specifying the rights and duties of EECO as the Data Controller and of the assigned party as the Data Processor. The agreement shall specify the categories of Personal Data to be processed, the purposes and scope of processing, and other relevant terms. The Data Processor shall process Personal Data only within the scope specified in the agreement and in accordance with EECO’s instructions, and shall not process it for other purposes.

8. Security Measures

EECO shall establish measures for the collection, use or disclosure of data, including Personal Data security measures, for its staff members and other relevant persons in accordance with the PDPA and the regulations, rules, criteria, laws and practices relating to Personal Data protection, to ensure effective and secure protection of Personal Data in accordance with the standards prescribed by law.

9. Personal Data Retention Period

EECO shall retain Data Subjects’ Personal Data only for as long as it remains necessary for the purposes of collection, in accordance with the details specified in the relevant policies, notices or applicable laws.

Once the retention period has expired and the Personal Data processed is no longer necessary for those purposes, EECO shall erase, destroy or anonymize it in accordance with the methods and standards for erasing or destroying Personal Data prescribed by the Personal Data Protection Committee or by law, or in accordance with international standards. However, where there is a dispute concerning the exercise of rights or litigation relating to your Personal Data, EECO reserves the right to retain such data until the dispute is resolved by a final order or judgment.

10. Rights of Data Subjects

Data Subjects have the following rights as prescribed by law:

  1. The right to access and obtain a copy of their Personal Data, or to request disclosure of how Personal Data obtained without their consent was acquired.
  2. The right to have inaccurate Personal Data rectified.
  3. The right to have Personal Data erased, destroyed or rendered incapable of identifying the Data Subject.
  4. The right to withdraw consent.
  5. The right to receive or transfer Personal Data.
  6. The right to request restriction of the use of Personal Data.
  7. The right to object to the collection, use or disclosure of Personal Data.
  8. The right to lodge a complaint with officials or the authority responsible for supervising Personal Data protection.


The exercise of these rights shall not affect the processing of Personal Data to which the Data Subject has lawfully consented, nor shall it conflict with compliance with any other laws with which EECO is required to comply.

11. Contact Details for Enquiries and the Exercise of Rights

If you have any questions about this Personal Data Protection Policy or wish to exercise your rights as a Data Subject, please contact:

  • Email: pdpa@eeco.or.th
  • Website: https://eeco.or.th
  • Telephone: 02-033-8000
  • Eastern Economic Corridor Office (EECO), 25th Floor, NT Bangrak Building, 72 Charoen Krung Road, Bang Rak Subdistrict, Bang Rak District, Bangkok 10500, Thailand

12. Review and Amendment of the Personal Data Protection Policy

EECO shall review and amend this Personal Data Protection Policy as necessary and appropriate to ensure consistency with relevant laws and rules, comments or recommendations from various agencies, and Personal Data protection practices. This is intended to improve EECO’s Personal Data protection processes in response to operational and technological changes and to ensure effective and appropriate security. EECO shall announce such amendments.

Privacy Notice for the EEC One Stop Service System (EEC OSS)

The Eastern Economic Corridor Office of Thailand (hereinafter referred to as “EECO”, “we”, “us” or “our”) recognizes the importance of protecting the personal data of persons who contact us and use the EEC One Stop Service System (“EEC OSS”) (“you” or “your”). We will safeguard and manage your personal data transparently, fairly and in accordance with the requirements of personal data protection law and other applicable laws. This Privacy Notice (“Notice”) informs you of how EECO, in its capacity as a data controller, collects, uses, discloses and protects your personal data. We recommend that you read and understand this Notice before providing your personal data to us. If you have any concerns or questions, or require further information about this Notice or other relevant notices and policies, please contact us using the contact details provided at the end of this Notice.

This Notice applies to data subjects who contact us and use EEC OSS. It covers the collection, use or disclosure of personal data and the rights of data subjects, as follows.

1. Collection of Your Personal Data

Personal data means information relating to an individual that enables that individual to be identified, directly or indirectly, but excludes information relating specifically to deceased persons. Examples include first names, surnames, national identification card numbers, telephone numbers,
dates of birth, personal codes, photographs and video recordings from closed-circuit television (CCTV) cameras. We generally collect personal data that you provide directly to us through EEC OSS, by email or through other channels established to facilitate your requests for services. In some cases, however, we may receive your personal data from third parties whom we believe in good faith to be entitled to collect your personal data and disclose it to us. We will collect only the personal data necessary and use it for the specified lawful purposes, or to comply with legal requirements obliging EECO to collect such data. When you contact us or use EEC OSS, we are required to comply with laws that oblige EECO to collect data relating to your access and use, such as your IP address. In addition, to facilitate your use of our website or application, we may use automated technologies to collect usage data. These may include cookies and similar tracking technologies, collectively referred to as “Cookies”. Further details about our use of cookies are available in the Cookie Notice.

Sensitive personal data: Personal data protection law specifies certain categories of personal data as sensitive personal data, such as racial origin, religious beliefs, sexual behaviour, political opinions, disabilities, genetic data, biometric data and health data. The collection of such data must comply with the law and may require your consent. We will therefore collect sensitive personal data only where necessary. We will clearly inform you of the reasons why such collection is necessary and may, in certain cases, seek your consent to collect such sensitive personal data.

The personal data that we may collect in connection with your use of EEC OSS is set out below. The data collected may differ from one service to another according to what is necessary to provide that service in each case.    

  • Personal details, such as first name, middle name, surname, national identification card number, passport number and photograph.
  • Contact details, such as email address, telephone number, address, social media contact channels and workplace.
  • Employment-related information, such as occupation, position, affiliated organization, expertise and experience.
  • Technical and data usage information, such as your IP address when you access EECO services online.
  • System usage information, such as transaction details, communications and service requests between you and EECO, and information recorded by cookies.
  • Other personal details that you voluntarily provide to EECO.

2. Purposes of Collecting Your Personal Data

We may need to collect, use or disclose your personal data for the following purposes:
  • To enable access to EEC OSS, including applications and registration for user accounts to verify your identity when requesting services, privileges, approvals and permits.
  • To assess and consider your service requests, including issuing documents and evidence of approvals and permits.
  • To contact you, coordinate or take relevant action in connection with your service requests or complaints, including contacting you for additional information or to provide progress updates, where applicable.
  • To enable us to provide assistance and respond to your enquiries or complaints.
  • To analyze data and study service usage behaviour, including seeking your opinions and satisfaction feedback, for research and marketing, and to develop and improve EEC OSS services and promotional activities to enhance your experience when using our services.
  • To conduct research and surveys on users’ information and opinions concerning the services.
  • To inform you about our activities and news and invite you to participate in our activities.
  • To ensure the security of service use. We may review the data collected to monitor and prevent corruption, crime, unlawful acts or misuse of the services.
  • To perform the duties imposed on EECO under the law governing EECO or other applicable laws.

3. Legal Bases for the Collection, Use and Disclosure of Personal Data

We will collect, use and disclose your personal data only to the extent necessary and in accordance with personal data protection law. That law establishes various legal grounds applicable in different circumstances, allowing EECO, as a data controller under the law, to collect, use and disclose your personal data.

In providing EEC OSS services, we will collect, use and disclose your personal data on the following legal bases:

  • Where necessary for the performance of a contract to which you and EECO are parties, or to take steps at your request before entering into a contract with EECO (Contract).
  • Where necessary for the performance of a task carried out in the public interest by EECO or the exercise of official authority vested in EECO (Public Task / Official Authority).
  • Where necessary for the legitimate interests of EECO or another person or juristic person, except where those interests are overridden by your fundamental rights in your personal data (Legitimate Interests).
  • Where necessary for compliance with applicable laws (Legal Obligation).
  • Where you have given your consent to EECO (Consent).


Where EECO needs to collect your personal data for the performance of a contract or compliance with laws, failure to provide the necessary personal data may result in EECO being unable to provide services or assistance to you.

4. To Whom Does EECO Disclose Your Data

We will not publish, sell, distribute, give away, exchange, transfer or disclose any of your personal data that we have collected to third parties, except for the purposes specified in this Notice, at your request or with your consent, or in certain circumstances where it may be necessary to send data to external organizations for processing in accordance with contractual or statutory duties and responsibilities, as follows.

4.1 Within EECO

Your personal data may be disclosed or transmitted to relevant units within EECO that have the requisite duties, only to the extent necessary for the relevant purposes. Access by these EECO personnel or teams will be authorized as necessary and appropriate, and limited to relevant personnel, with access rights assigned according to their roles and responsibilities.

4.2 Outside EECO

Your personal data may be disclosed or transmitted to the following parties outside EECO or in the following circumstances:

  • Government agencies with statutory responsibilities that are involved in considering your service requests and granting approvals or permits. EECO may be required to examine, assess, consider and approve or permit your requests jointly with those agencies, or to refer your requests to them for examination, assessment, consideration and approval or permission.
  • Third parties whose services are connected to EEC OSS, such as identity proofing and authentication systems.
  • Your duly authorized attorneys-in-fact, substitute attorneys-in-fact, agents or legal representatives.
  • Organizations or individuals acting on behalf of, or working for, EECO as data processors, with whom data processing agreements or contracts are entered into to ensure that they comply with personal data protection law in the same manner as EECO.
  • Where we believe in good faith that disclosure is required by law, is necessary to comply with an order of a government official with lawful authority, or is pursuant to a court summons, court order or judicial process.
  • Where we believe in good faith and on reasonable grounds that disclosure of your personal data is necessary in exceptional circumstances that we consider to outweigh the protection of your privacy, namely:
    • To investigate, conduct inquiries into and suppress crime, corruption or fraud; or
    • To prevent or respond to threats or acts that may harm the rights, property or safety of the public, including those of EECO and relevant persons; or
    • To prevent or respond to violations of our terms of service or the law.


If we have concerns about your physical safety, or consider it necessary to take action to protect you from threats or acts that may cause you harm, we will consult you and, where possible, seek your permission before informing other persons who need to know about your situation.

If any of the circumstances described above arise, we will keep a record of the data disclosed, the reasons for disclosure and the circumstances in which disclosure was made, so that you can ascertain what actions we have taken in relation to your personal data.

5. Rights of Data Subjects

As a data subject, you have rights under personal data protection law. We attach great importance to supporting and facilitating the exercise of these rights, as follows:

  • Right to be informed: We will provide a Privacy Notice that clearly specifies the purposes of collecting, using and disclosing personal data.
  • Right to withdraw consent: You may withdraw the consent you previously gave to EECO at any time.
  • Right of access: You may request access to and a copy of your personal data, or disclosure of how personal data obtained without your consent was acquired.
  • Right to rectification: You may request correction of inaccurate personal data so that it is accurate, up to date and not misleading.
  • Right to erasure or destruction of personal data, or to have it rendered incapable of identifying the data subject.
  • Right to receive or transfer personal data: Where our data systems support formats that can be read or commonly used by automated tools or equipment, and the personal data can be used or disclosed by automated means, you may request a copy of your personal data, request its transfer to another data controller by automated means, and request receipt of the personal data so sent or transferred.
  • Right to request restriction of the use of personal data.
  • Right to object to the collection, use or disclosure of personal data.
  • Right to lodge a complaint with officials or the authority responsible for supervising personal data protection.


In certain cases, we may refuse a request to exercise the above rights where there are lawful grounds to do so; where the action is for a purpose, or in circumstances, requiring compliance with a law or court order; where it may adversely affect or harm the rights or freedoms of the data subject or another person; or where your personal data has been rendered anonymous or stripped of characteristics that could identify you.

If you, as a data subject, successor in title, heir, legal representative, custodian or curator, as applicable, wish to exercise these rights, you may contact us using the contact details below. We may also retain a record of your request as evidence.

6. Personal Data Security Measures

We recognize the trust you place in us by providing us with important information. Personal data protection law requires EECO, as a data controller, to put in place security measures and management arrangements to ensure that such data is protected and available for access and review by data subjects.

 We have implemented personal data security measures under EECO’s Information Security Policy and practices to prevent the loss of personal data and unauthorized access, destruction, use, alteration, modification or disclosure.

7. Data Storage and Transfer

We store, use and process your personal data on cloud systems located in Thailand. In some cases, however, transfers for storage or processing may need to take place across locations or countries, or your personal data may need to be sent or transferred abroad for the purposes of providing services to you. We will always verify that such transfers are secure, that recipients have data safeguards and protection measures meeting the standards prescribed by law, and that such sending or transfer complies with the rules prescribed by the Personal Data Protection Committee for the protection of personal data sent or transferred abroad. Exceptions apply where EECO is required by law to send or transfer personal data abroad, or where we have informed you and obtained your consent in a case where the destination country has inadequate personal data protection standards, in accordance with the list of countries announced by the Personal Data Protection Committee.

8. Personal Data Retention Period

We will retain your personal data only for as long as it remains necessary for the purposes of collection and as required by law. Personal data in your member account and in your service requests will be retained throughout your membership and for no more than 10 years from the date your member account is cancelled. We will permanently delete your member account so that the data in it cannot be recovered.

However, we may need to retain your personal data beyond the period specified above if we are notified of or believe in good faith that there may have been, a breach of EECO’s terms of service, a violation of law or a dispute, and an investigation, inquiry or the gathering of evidence for legal proceedings is necessary. We will retain your personal data for as long as necessary until the process is completed, or for the period prescribed by the relevant law.

At the end of the applicable retention period, we will erase or destroy the personal data, or render it incapable of identifying the data subject.

9. Review and Amendment of This Notice

We may update, amend or change this Notice from time to time to ensure that its contents remain appropriate, up to date and consistent with personal data protection law and other applicable laws. If we update, amend or change this Notice, we will display the latest version and notify you through appropriate channels. We recommend that you read and review this Notice regularly, particularly before submitting personal data through our services.

10. Contact Details

If you have any questions, suggestions, comments or feedback, require further information about this Notice, or wish to exercise your rights as a data subject, please contact us at: Data Protection Officer (DPO) Alternatively, for enquiries about the system’s services:
  • Investment Service Division 
Eastern Economic Corridor Office (EECO), Chon Buri Nawavit Burapha Vanich Building, Burapha University 169 Long-Had Bangsaen Road, Saensuk Subdistrict, Mueang Chon Buri District, Chon Buri 20131, Thailand Office hours: Monday–Friday, 09:00– 17:00 hrs, excluding public holidays
  • Telephone: +66 2033 8000 ext. 4071–4073, Office hours: Monday–Friday, 09:00– 17:00 hrs
  • Email: eec-oss@eeco.or.th

Privacy Notice for Committee Members, Executives, Personnel and Job Applicants

The Eastern Economic Corridor Office (hereinafter referred to as “EECO”, “we”, “us” or “our”) recognizes the importance of protecting the personal data of committee members, executives, personnel and job applicants (“you” or “your”). We will safeguard and manage your personal data transparently, fairly and in accordance with the requirements of personal data protection law and other applicable laws. This Privacy Notice (“Notice”) informs you of how EECO, in its capacity as a data controller, collects, uses, discloses and protects your personal data. We recommend that you read and understand this Notice before providing your personal data to us. If you have any concerns or questions, or require further information about this Notice or other relevant notices and policies, please contact us using the contact details provided at the end of this Notice.

This Notice applies to the following categories of data subjects:

1. Committee members, executives and personnel, as follows:

           1.1 “Committees” means the Eastern Economic Corridor Policy Committee, the Appeal Committee, ad hoc committees, the Audit Committee, the Management Committee of the Eastern Economic Corridor Development Fund, other committees and subcommittees under the law governing the Eastern Economic Corridor.

           1.2 “Executives” means the Secretary-General, Deputy Secretaries-General, Special Experts, Special Advisers, Internal Auditors, Assistant Secretaries-General and executives of the Eastern Economic Corridor Development Fund under the law governing the Eastern Economic Corridor.

           1.3 “Personnel” means EECO’s staff members and employees.

2. Job applicants.

Our collection, use or disclosure of personal data and the rights of data subjects are described below.

1. Collection of Your Personal Data

Personal data means information relating to an individual that enables that individual to be identified, directly or indirectly, but excludes information relating specifically to deceased persons. Examples include first names, surnames, national identification card numbers, telephone numbers, dates of birth, personal codes, photographs and video recordings from closed-circuit television (CCTV) cameras. We generally collect personal data that you provide directly to us through our procedures by completing forms, documents or online webforms, by email or through other channels established to facilitate your requests for services. In some cases, however, we may receive your personal data from third parties whom we believe in good faith to be entitled to collect your personal data and disclose it to us. We will collect only the personal data necessary and use it for the specified lawful purposes, or to comply with legal requirements obliging EECO to collect such data.

Sensitive personal data: Personal data protection law designates certain categories of data as sensitive, such as racial origin, religious beliefs, sexual behaviour, political opinions, disabilities, genetic data, biometric data and health data. The collection of such data must comply with the law and may require your consent. We will therefore collect sensitive personal data only where necessary. We will clearly inform you of the reasons why such collection is necessary and may, in certain cases, seek your consent to collect such sensitive personal data.

The personal data that we may collect in connection with your dealings with us through our procedures is set out below. The data collected may differ from one service to another according to what is necessary to provide that service in each case.

  • Personal details, such as first name, middle name, surname, national identification card number, passport number and photograph.
  • Contact details, such as email address, telephone number, address, social media contact channels and workplace.
  • Employment-related information, such as occupation, position, affiliated organization, expertise and experience.
  • Background information, such as marital status, military service status, nationality, date of birth and sex.
  • Educational information, such as level of education, educational history and training undertaken.
  • Work-related information, such as job position, line manager, benefits and entitlements, employment commencement date, absence records, time records and annual leave records.
  • Technical and data usage information, such as your IP address when you access EECO services online.
  • System usage information, such as transaction details, communications and service requests between you and EECO, and information recorded by cookies.
  • Financial information, such as bank account details and bank account numbers.
  • Supporting documents, such as academic transcripts.
  • Other personal details that you voluntarily provide to EECO.


In addition, EECO may process sensitive personal data in certain cases, such as:

  • Health data, such as information concerning health and safety, drug test reports and medical certificates.
  • Biometric data, such as fingerprints and facial recognition data.
  • Background information, such as criminal records.

2. Purposes of Collecting Your Personal Data

We may need to collect, use or disclose your personal data for the following purposes:

  • To assess qualifications, select candidates and communicate regarding job applications.
  • To consider employment contracts and benefits and carry out human resources management.
  • To control entry to and exit from office buildings and restricted areas.
  • To authorize and control access to online forms and various operational systems.
  • To perform the duties imposed on EECO under the law governing EECO or other applicable laws.

3. Legal Bases for the Collection, Use and Disclosure of Personal Data

We will collect, use and disclose your personal data only to the extent necessary and in accordance with personal data protection law. That law establishes various legal grounds applicable in different circumstances, allowing EECO, as a data controller under the law, to collect, use and disclose your personal data.

When processing the personal data of personnel, job applicants and interns, we will collect, use and disclose your personal data on the following legal bases:

  • For the preparation of historical documents or archives for the public interest, or for research or statistical purposes (Scientific or Research).
  • To prevent or suppress a danger to the life, body or health of the data subject (Vital Interest).
  • Where necessary for the performance of a contract to which you and EECO are parties, or to take steps at your request before entering into a contract with EECO (Contract).
  • Where necessary for the performance of a task carried out in the public interest by EECO or the exercise of official authority vested in EECO (Public Task / Official Authority).
  • Where necessary for the legitimate interests of EECO or another person or juristic person, except where those interests are overridden by your fundamental rights in your personal data (Legitimate Interests).
  • Where necessary for compliance with applicable laws (Legal Obligation).
  • Where you have given your consent to EECO (Consent).

Where EECO needs to collect your personal data for the performance of a contract or compliance with laws, failure to provide the necessary personal data may result in EECO being unable to provide services or assistance to you.

4. Parties to Whom EECO Discloses Your Personal Data

We will not publish, sell, distribute, give away, exchange, transfer or disclose any of your personal data that we have collected to third parties, except for the purposes specified in this Notice, at your request or with your consent, or in certain circumstances where it may be necessary to send data to external organizations for processing in accordance with contractual or statutory duties and responsibilities, as follows.

4.1 Within EECO

Your personal data may be disclosed or transmitted to relevant units within EECO that have the requisite duties, only to the extent necessary for the relevant purposes. Access by these EECO personnel or teams will be authorized as necessary and appropriate, including:

  • Relevant personnel only, with access rights assigned according to their roles and responsibilities.
  • Executives or your direct supervisors who are responsible for managing or making decisions concerning you, or who need to be involved in personnel procedures.


4.2 Outside EECO

Your personal data may be disclosed or transmitted to the following parties outside EECO or in the following circumstances:

  • External organizations that provide services or support for EECO’s activities, such as contracted hospitals, contracted insurance companies, contracted life insurance companies and Payroll and Pack Service Co., Ltd.
  • Banks, such as Krung Thai Bank.
  • Relevant government agencies or other regulatory authorities, such as the Revenue Department and the Courts of Justice.
  • Where we believe in good faith and on reasonable grounds that disclosure of your personal data is necessary in exceptional circumstances that we consider to outweigh the protection of your privacy, namely:
    • To investigate, conduct inquiries into and suppress crime, corruption or fraud; or
    • To prevent or respond to threats or acts that may harm the rights, property or safety of the public, including those of EECO and relevant persons; or
    • To prevent or respond to violations of our terms of service or the law.


If we have concerns about your physical safety, or consider it necessary to take action to protect you from threats or acts that may cause you harm, we will consult you and, where possible, seek your consent before informing other persons who need to know about your situation.

If any of the circumstances described above arise, we will keep a record of the data disclosed, the reasons for disclosure and the circumstances in which disclosure took place, so that you can ascertain what actions we have taken in relation to your personal data.

5. Rights of Data Subjects

As a data subject, you have rights under personal data protection law. We attach great importance to supporting and facilitating the exercise of these rights, as follows:

  • Right to be informed: We will provide a Privacy Notice that clearly specifies the purposes of collecting, using and disclosing personal data.
  • Right to withdraw consent: You may withdraw the consent you previously gave to EECO at any time.
  • Right of access: You may request access to and a copy of your personal data, or disclosure of how personal data obtained without your consent was acquired.
  • Right to rectification: You may request correction of inaccurate personal data so that it is accurate, up to date and not misleading.
  • Right to erasure or destruction of personal data, or to have it rendered incapable of identifying the data subject.
  • Right to receive or transfer personal data: Where our data systems support formats that can be read or commonly used by automated tools or equipment, and the personal data can be used or disclosed by automated means, you may request a copy of your personal data, request its transfer to another data controller by automated means, and request receipt of the personal data so sent or transferred.
  • Right to request restriction of the use of personal data.
  • Right to object to the collection, use or disclosure of personal data.
  • Right to lodge a complaint with officials or the authority responsible for supervising personal data protection.


In certain cases, we may refuse or be unable to fulfil a request to exercise the above rights where there are lawful grounds to do so; where the action is for a purpose, or in circumstances, requiring compliance with a law or court order; where it may adversely affect or harm the rights or freedoms of the data subject or another person; or where your personal data has been rendered anonymous or stripped of characteristics that could identify you.

If you, as a data subject, successor in title, heir, legal representative, custodian or curator, as applicable, wish to exercise these rights, you may contact us using the contact details below. We may also retain a record of your request as evidence.

6. Personal Data Security Measures

We recognize the trust you place in us by providing us with important information. Personal data protection law requires EECO, as a data controller, to put in place security measures and management arrangements to ensure that such data is protected and available for access and review by data subjects.

We have implemented personal data security measures under EECO’s Information Security Policy and practices to prevent the loss of personal data and unauthorized access, destruction, use, alteration, modification or disclosure.

7. Data Storage and Transfer

We store, use and process your personal data on cloud systems located in Thailand. In some cases, however, transfers for storage or processing may need to take place across locations or countries, or your personal data may need to be sent or transferred abroad for the purposes of providing services to you. We will always verify that such transfers are secure, that recipients have data safeguards and protection measures meeting the standards prescribed by law, and that such sending or transfer complies with the rules prescribed by the Personal Data Protection Committee for the protection of personal data sent or transferred abroad. Exceptions apply where EECO is required by law to send or transfer personal data abroad, or where we have informed you and obtained your consent in a case where the destination country has inadequate personal data protection standards, in accordance with the list of countries announced by the Personal Data Protection Committee.

8. Personal Data Retention Period

We will retain your personal data only for as long as it remains necessary for the purposes of collection and as required by law.

8.1 If you are not selected for employment as a staff member, EECO will retain your data for 1 year from the date on which you are notified of the selection outcome, for consideration for other positions that may be suitable for you in the future and for verification and reference purposes, unless you request that your data be erased or destroyed before the end of that period.

8.2 For committee members, executives and personnel, EECO will retain your personal data throughout your employment or term of office and for a further 10 years after the end of your employment or after you leave office, for compliance with laws and for necessary verification and reference purposes. An exception applies to criminal record data, which will be retained for no more than six months from the date of receipt for legal verification and reference purposes. EECO will then erase or destroy such data in accordance with our procedures.

However, we may need to retain your personal data beyond the periods specified above if we are notified of, or believe in good faith that there may have been, a breach of EECO’s terms of service, a violation of law or a dispute, and investigation, inquiry or the gathering of evidence for legal proceedings is necessary. We will retain your personal data for as long as necessary until the process is completed, or for the period prescribed by the relevant law.

At the end of the applicable retention period, we will erase or destroy the personal data, or render it incapable of identifying the data subject.

9. Review and Amendment of This Notice

We may update, amend or change this Notice from time to time to ensure that its contents remain appropriate, up to date and consistent with personal data protection law and other applicable laws. If we update, amend or change this Notice, we will display the latest version and notify you through appropriate channels. We recommend that you read and review this Notice regularly, particularly before submitting personal data through our services.

10. Contact Details

If you have any questions, suggestions, comments or feedback, require further information about this Notice, or wish to exercise your rights as a data subject, please contact us at:

Data Protection Officer (DPO)

  • Email: pdpa@eeco.or.th
  • Telephone: +66 2033 8000 
  • Eastern Economic Corridor Office (EECO)
    25th Floor, NT Bangrak Building, Charoen Krung Road, Bang Rak, Bangkok 10500, Thailand

Privacy Notice for Network Partners

The Eastern Economic Corridor Office (hereinafter referred to as “EECO”, “we”, “us” or “our”) recognizes the importance of protecting the personal data of network partners who contact or use the services of EECO, or conduct transactions with EECO (“you” or “your”). We will safeguard and manage your personal data transparently, fairly and in accordance with the requirements of personal data protection law and other applicable laws. This Privacy Notice (“Notice”) informs you of how EECO, in its capacity as a data controller, collects, uses, discloses and protects your personal data. We recommend that you read and understand this Notice before providing your personal data to us. If you have any concerns or questions, or require further information about this Notice or other relevant notices and policies, please contact us using the contact details provided at the end of this Notice.

This Notice applies to network partners, covering data subjects associated with network partners that engage in the following activities with EECO:

  1. Signing memoranda of understanding on cooperation (MOU), operational agreements (MOA), letters of intent to invest (LOI) and non-disclosure agreements (NDA), for example, by investors and business operators.
  2. Procurement procedures, for example, those involving contractors (Vendors).
  3. Attracting business operators and investors interested in investing in Special Targeted Industries.
  4. Applying for funding allocations from the Eastern Economic Corridor Development Fund, for example, by business operators, community enterprise operators and social enterprise operators.
  5. Activities concerning Special Economic Promotion Zones, such as applications for the establishment, modification or dissolution of such zones; registration of land leases; applications for approvals or permissions under Section 43 of the Eastern Economic Corridor Act B.E. 2561 (2018); applications for benefits; and payment of compensation where other persons have pre-existing rights to use the land under the law governing agricultural land reform.
  6. Area and community development activities, such as the Model Community Products Project; the Project to Sustainably Link Investment Benefits to Local Communities (EEC Connect); the Project to Promote and Enhance Product Value for Secure Livelihoods and Incomes (EEC Select); the Project to Create Added Value from Local Culinary Knowledge in the EEC; the Project to Raise Awareness among Local Residents of EECO’s Role; the Project on Opportunities and Grassroots Economic Development in the EEC; and other projects that EECO may undertake in the future.
  7. Human resource development in the Eastern Economic Corridor through the Personnel Development Project (EEC Model Type A), the Skills Enhancement and Personnel Development Project for Targeted Industries (EEC Model Type B), the Skills Enhancement Project to Prepare the Workforce for Investment (EEC Model Type C), or other projects that EECO may undertake in the future, for example, involving project operators, participating students or participating employees.


Our collection, use or disclosure of personal data and the rights of data subjects are described below.

1. Collection of Your Personal Data

Personal data means information relating to an individual that enables that individual to be identified, directly or indirectly, but excludes information relating specifically to deceased persons. Examples include first names, surnames, national identification card numbers, telephone numbers, dates of birth, personal codes, photographs and video recordings from closed-circuit television (CCTV) cameras. We generally collect personal data that you provide directly to us through our systems, by email or through other channels established to facilitate your requests for services. In some cases, however, we may receive your personal data from third parties whom we believe in good faith to be entitled to collect your personal data and disclose it to us. We will collect only the personal data necessary and use it for the specified lawful purposes, or to comply with legal requirements obliging EECO to collect such data.

Sensitive personal data: Personal data protection law designates certain categories of data as sensitive, such as racial origin, religious beliefs, sexual behaviour, political opinions, disabilities, genetic data, biometric data and health data. The collection of such data must comply with the law and may require your consent. We will therefore collect sensitive personal data only where necessary. We will clearly inform you of the reasons why such collection is necessary and may, in certain cases, seek your consent to collect such sensitive personal data.

We may collect the following personal data when you contact EECO, participate in its activities or request its services, or when EECO undertakes research and surveys as part of its functions. We collect such data directly through your contacts with EECO, use of its services or participation in its activities, including through forms, documents, online webforms, email, business cards or other channels established to facilitate your requests for services:

  • Personal details, such as first name, middle name, surname, national identification card number, passport number and photograph.
  • Contact details, such as email address, telephone number, address, social media contact channels and workplace.
  • Employment-related information, such as occupation, position, affiliated organization, expertise and experience.
  • Technical and system usage information, such as IP address, transaction details, communications and service requests between you and EECO, and information recorded by cookies.
  • Financial information, such as bank account details and bank account numbers.
  • Other personal details that you voluntarily provide to EECO.

2. Purposes of Collecting Your Personal Data

We may need to collect, use or disclose your personal data for the following purposes:

  • To compile a database of contacts, business operators and investors interested in investing in Special Targeted Industries, or for other communications and coordination relating to EECO, including opinion surveys for analyzing and improving the performance of EECO’s functions.
  • To provide assistance, answer enquiries or contact you to request additional information or provide updates on progress.
  • To provide information for investors, business operators and community enterprises in connection with area and community development activities.
  • To analyze and monitor workforce demand and the competencies required by industry; record the number of project participants; support employment; and enhance the skills of personnel in workplaces, as part of human resource development in the Eastern Economic Corridor.
  • To maintain a database and facilitate communications concerning applications for the establishment, modification or dissolution of Special Economic Promotion Zones; registration of land leases; applications for approvals or permissions under Section 43 of the Eastern Economic Corridor Act B.E. 2561 (2018); applications for benefits; and payment of compensation where other persons have pre-existing rights to use the land under the law governing agricultural land reform.
  • For publication and public relations through various channels, such as EECO’s internal email, EECO’s website, Facebook, LINE, YouTube or other EECO online media.
  • To publicize other EECO activities and invite you to participate in future activities (your consent will be sought in this case).
  • For analysis and the compilation of statistical information. Information obtained from surveys will be processed and presented in aggregate form using methods that prevent individuals from being identified.
  • For EECO’s procurement and supplies management.
  • For communications and coordination, and to carry out the signing of memoranda of understanding on cooperation (MOU), operational agreements (MOA), letters of intent to invest (LOI) and non-disclosure agreements (NDA).

3. Legal Bases for the Collection, Use and Disclosure of Personal Data

We will collect, use and disclose your personal data only to the extent necessary and in accordance with personal data protection law. That law establishes various legal grounds applicable in different circumstances, allowing EECO, as a data controller under the law, to collect, use and disclose your personal data.

When processing the personal data of network partners, we will collect, use and disclose your personal data on the following legal bases:

  • For the preparation of historical documents or archives for the public interest, or for research or statistical purposes (Scientific or Research).
  • To prevent or suppress a danger to the life, body or health of the data subject (Vital Interest).
  • Where necessary for the performance of a contract to which you and EECO are parties, or to take steps at your request before entering into a contract with EECO (Contract).
  • Where necessary for the performance of a task carried out in the public interest by EECO or the exercise of official authority vested in EECO (Public Task / Official Authority).
  • Where necessary for the legitimate interests of EECO or another person or juristic person, except where those interests are overridden by your fundamental rights in your personal data (Legitimate Interests).
  • Where necessary for compliance with applicable laws (Legal Obligation).
  • Where you have given your consent to EECO (Consent).

4. Parties to Whom EECO Discloses Your Personal Data

We will not publish, sell, distribute, give away, exchange, transfer or disclose any of your personal data that we have collected to third parties, except for the purposes specified in this Notice, at your request or with your consent, or in certain circumstances where it may be necessary to send data to external organizations for processing in accordance with contractual or statutory duties and responsibilities, as follows.

4.1 Within EECO

Your personal data may be disclosed or transmitted to relevant units within EECO that have the requisite duties, only to the extent necessary for the relevant purposes. Access by these EECO personnel or teams will be authorized as necessary and appropriate, and limited to relevant personnel, with access rights assigned according to their roles and responsibilities.

4.2 Outside EECO

Your personal data may be disclosed or transmitted to the following parties outside EECO or in the following circumstances:

  • Organizations or individuals working on behalf of or for EECO as data processors. A data processing agreement or contract will be put in place to ensure that such organizations or individuals comply with the requirements of personal data protection law in the same manner as EECO.
  • Where we believe in good faith and on reasonable grounds that disclosure of your personal data is necessary in exceptional circumstances that we consider to outweigh the protection of your privacy, namely:
    • To investigate, conduct inquiries into and suppress crime, corruption or fraud; or
    • To prevent or respond to threats or acts that may harm the rights, property or safety of the public, including those of EECO and relevant persons; or
    • To prevent or respond to violations of our terms of service or the law.


If we have concerns about your physical safety, or consider it necessary to take action to protect you from threats or acts that may cause you harm, we will consult you and, where possible, seek your consent before informing other persons who need to know about your situation.

If any of the circumstances described above arise, we will keep a record of the data disclosed, the reasons for disclosure and the circumstances in which disclosure took place, so that you can ascertain what actions we have taken in relation to your personal data.

5. Rights of Data Subjects

As a data subject, you have rights under personal data protection law. We attach great importance to supporting and facilitating the exercise of these rights, as follows:

  • Right to be informed: We will provide a Privacy Notice that clearly specifies the purposes of collecting, using and disclosing personal data.
  • Right to withdraw consent: You may withdraw the consent you previously gave to EECO at any time.
  • Right of access: You may request access to and a copy of your personal data, or disclosure of how personal data obtained without your consent was acquired.
  • Right to rectification: You may request correction of inaccurate personal data so that it is accurate, up to date and not misleading.
  • Right to erasure or destruction of personal data, or to have it rendered incapable of identifying the data subject.
  • Right to receive or transfer personal data: Where our data systems support formats that can be read or commonly used by automated tools or equipment, and the personal data can be used or disclosed by automated means, you may request a copy of your personal data, request its transfer to another data controller by automated means, and request receipt of the personal data so sent or transferred.
  • Right to request restriction of the use of personal data.
  • Right to object to the collection, use or disclosure of personal data.
  • Right to lodge a complaint with officials or the authority responsible for supervising personal data protection.


In certain cases, we may refuse a request to exercise the above rights where there are lawful grounds to do so; where the action is for a purpose, or in circumstances, requiring compliance with a law or court order; where it may adversely affect or harm the rights or freedoms of the data subject or another person; or where your personal data has been rendered anonymous or stripped of characteristics that could identify you.

If you, as a data subject, successor in title, heir, legal representative, custodian or curator, as applicable, wish to exercise these rights, you may contact us using the contact details below. We may also retain a record of your request as evidence.

6. Personal Data Security Measures

We recognize the trust you place in us by providing us with important information. Personal data protection law requires EECO, as a data controller, to put in place security measures and management arrangements to ensure that such data is protected and available for access and review by data subjects.

We have implemented personal data security measures under EECO’s Information Security Policy and practices to prevent the loss of personal data and unauthorized access, destruction, use, alteration, modification or disclosure.

7. Data Storage and Transfer

We store, use and process your personal data on cloud systems located in Thailand. In some cases, however, transfers for storage or processing may need to take place across locations or countries, or your personal data may need to be sent or transferred abroad for the purposes of providing services to you. We will always verify that such transfers are secure, that recipients have data safeguards and protection measures meeting the standards prescribed by law, and that such sending or transfer complies with the rules prescribed by the Personal Data Protection Committee for the protection of personal data sent or transferred abroad. Exceptions apply where EECO is required by law to send or transfer personal data abroad, or where we have informed you and obtained your consent in a case where the destination country has inadequate personal data protection standards, in accordance with the list of countries announced by the Personal Data Protection Committee.

8. Personal Data Retention Period

We will retain your personal data only for as long as it remains necessary for the purposes of collection and as required by law.

8.1 For personal data relating to the signing of memoranda of understanding on cooperation (MOU), operational agreements (MOA), letters of intent to invest (LOI) and non-disclosure agreements (NDA), and personal data arising from procurement procedures, EECO will retain your data for as long as necessary during the term of the contract and for a further 10 years, counted from the year following the year in which the contract or our relationship with you ends.

8.2 For the personal data of business operators and investors interested in investing in Special Targeted Industries, and personal data processed in connection with applications for funding support from the Eastern Economic Corridor Development Fund, activities concerning Special Economic Promotion Zones, area and community development, and human resource development in the Eastern Economic Corridor, EECO will retain your data for the duration of your relationship with EECO in connection with its functions, or until retention is no longer necessary for the performance of EECO’s functions under its statutory powers.

However, we may need to retain your personal data beyond the periods specified above if we are notified of, or believe in good faith that there may have been, a breach of EECO’s terms of service, a violation of law or a dispute, and investigation, inquiry or the gathering of evidence for legal proceedings is necessary. We will retain your personal data for as long as necessary until the process is completed, or for the period prescribed by the relevant law.

At the end of the applicable retention period, we will erase or destroy the personal data, or render it incapable of identifying the data subject.

9. Review and Amendment of This Notice

We may update, amend or change this Notice from time to time to ensure that its contents remain appropriate, up to date and consistent with personal data protection law and other applicable laws. If we update, amend or change this Notice, we will display the latest version and notify you through appropriate channels. We recommend that you read and review this Notice regularly, particularly before submitting personal data through our services.

10. Contact Details

If you have any questions, suggestions, comments or feedback, require further information about this Notice, or wish to exercise your rights as a data subject, please contact us at:

Data Protection Officer (DPO)

  • Email: pdpa@eeco.or.th
  • Telephone: +66 2033 8000
  • Eastern Economic Corridor Office (EECO)
    25th Floor, NT Bangrak Building, Charoen Krung Road, Bang Rak, Bangkok 10500, Thailand

Privacy Notice for External Parties

The Eastern Economic Corridor Office (hereinafter referred to as “EECO”, “we”, “us” or “our”) recognizes the importance of protecting the personal data of external parties (“you” or “your”). We will safeguard and manage your personal data transparently, fairly and in accordance with the requirements of personal data protection law and other applicable laws. This Privacy Notice (“Notice”) informs you of how EECO, in its capacity as a data controller, collects, uses, discloses and protects your personal data. We recommend that you read and understand this Notice before providing your personal data to us. If you have any concerns or questions, or require further information about this Notice or other relevant notices and policies, please contact us using the contact details provided at the end of this Notice.

This Notice applies to the following categories of data subjects who are external parties:

  1. Participants in seminars, meetings, investor outreach activities and other EECO activities.
  2. Persons contacting or visiting EECO, and persons requesting access to EECO’s buildings, workplaces or office premises.
  3. Users of EECO’s website.
  4. Persons submitting complaints to EECO.

Our collection, use or disclosure of personal data and the rights of data subjects are described below.

1. Collection of Your Personal Data

Personal data means information relating to an individual that enables that individual to be identified, directly or indirectly, but excludes information relating specifically to deceased persons. Examples include first names, surnames, national identification card numbers, telephone numbers, dates of birth, personal codes, photographs and video recordings from closed-circuit television (CCTV) cameras. We generally collect personal data directly from you when you contact EECO, use its services or participate in its events, including through forms, documents, online webforms, email, CCTV cameras or other channels established to facilitate your requests for services. In some cases, however, we may receive your personal data from third parties whom we believe in good faith to be entitled to collect your personal data and disclose it to us. We will collect only the personal data necessary and use it for the specified lawful purposes, or to comply with legal requirements obliging EECO to collect such data.

Sensitive personal data: Personal data protection law designates certain categories of data as sensitive, such as racial origin, religious beliefs, sexual behaviour, political opinions, disabilities, genetic data, biometric data and health data. The collection of such data must comply with the law and may require your consent. We will therefore collect sensitive personal data only where necessary. We will clearly inform you of the reasons why such collection is necessary and may, in certain cases, seek your consent to collect such sensitive personal data.

The personal data that we may collect in connection with your dealings with us through our procedures is set out below. The data collected may differ from one service to another according to what is necessary to provide that service in each case.

  • Personal details, such as first name, middle name, surname, national identification card number, passport number and photograph.
  • Contact details, such as email address, telephone number, address, social media contact channels and workplace.
  • Employment-related information, such as occupation, position, affiliated organization, expertise and experience.
  • Background information, such as age, sex, date of birth, marital status, nationality and interest in activities organized by EECO.
  • IT-related information, such as IP address, user account (User ID), online transaction details, network usage history, times of information searches, website browsing history and information recorded by cookies.
  • Other personal details that you voluntarily provide to EECO.

2. Purposes of Collecting Your Personal Data

We may need to collect, use or disclose your personal data for the following purposes:

  • To verify registration for events and activities organized by EECO; maintain participant registers and records of participation; conduct activities; verify participants’ identities; communicate and coordinate with participants; provide details of participation in training sessions, seminars, study visits, activities to attract investors in Special Targeted Industries (roadshows), or other activities; and ensure security.
  • To provide assistance, answer enquiries or contact you to request additional information or provide updates on progress.
  • To analyze and compile statistical information. Some information, such as information about organizations, may be processed and presented in aggregate form using methods that prevent individuals from being identified.
  • To submit external stakeholder information to the Office of the National Anti-Corruption Commission for the External Integrity and Transparency Assessment (EIT).
  • To maintain records of and monitor website use.
  • To publicize other EECO activities and invite you to participate in future activities (your consent will be sought in this case).
  • EECO may take photographs, record video and/or audio, or conduct live broadcasts for the purpose of publicizing training sessions, seminars, study visits, activities to attract investors in Special Targeted Industries (roadshows), or other activities. EECO may disseminate such photographs, video and/or audio recordings, or live broadcasts through its internal and external public relations channels, such as online media or EECO’s website.

3. Legal Bases for the Collection, Use and Disclosure of Personal Data

We will collect, use and disclose your personal data only to the extent necessary and in accordance with personal data protection law. That law establishes various legal grounds applicable in different circumstances, allowing EECO, as a data controller under the law, to collect, use and disclose your personal data.

When processing the personal data of external parties, we will collect, use and disclose your personal data on the following legal bases:

  • For the preparation of historical documents or archives for the public interest, or for research or statistical purposes (Scientific or Research).
  • To prevent or suppress a danger to the life, body or health of the data subject (Vital Interest).
  • Where necessary for the performance of a contract to which you and EECO are parties, or to take steps at your request before entering into a contract with EECO (Contract).
  • Where necessary for the performance of a task carried out in the public interest by EECO or the exercise of official authority vested in EECO (Public Task / Official Authority).
  • Where necessary for the legitimate interests of EECO or another person or juristic person, except where those interests are overridden by your fundamental rights in your personal data (Legitimate Interests).
  • Where necessary for compliance with applicable laws (Legal Obligation).
  • Where you have given your consent to EECO (Consent).

4. Parties to Whom EECO Discloses Your Personal Data

We will not publish, sell, distribute, give away, exchange, transfer or disclose any of your personal data that we have collected to third parties, except for the purposes specified in this Notice, at your request or with your consent, or in certain circumstances where it may be necessary to send data to external organizations for processing in accordance with contractual or statutory duties and responsibilities, as follows.

4.1 Within EECO

Your personal data may be disclosed or transmitted to relevant units within EECO that have the requisite duties, only to the extent necessary for the relevant purposes. Access by these EECO personnel or teams will be authorized as necessary and appropriate, and limited to relevant personnel, with access rights assigned according to their roles and responsibilities.

4.2 Outside EECO

Your personal data may be disclosed or transmitted to the following parties outside EECO or in the following circumstances:

  • The Office of the National Anti-Corruption Commission.
  • Government agencies authorized to request personal data, such as the National Cyber Security Agency, the Office of the Personal Data Protection Committee, the Royal Thai Police, public prosecutors’ offices and courts.
  • Where we believe in good faith and on reasonable grounds that disclosure of your personal data is necessary in exceptional circumstances that we consider to outweigh the protection of your privacy, namely:
    • To investigate, conduct inquiries into and suppress crime, corruption or fraud; or
    • To prevent or respond to threats or acts that may harm the rights, property or safety of the public, including those of EECO and relevant persons; or
    • To prevent or respond to violations of our terms of service or the law.


If we have concerns about your physical safety, or consider it necessary to take action to protect you from threats or acts that may cause you harm, we will consult you and, where possible, seek your permission before informing other persons who need to know about your situation.

If any of the circumstances described above arise, we will keep a record of the data disclosed, the reasons for disclosure and the circumstances in which disclosure took place, so that you can ascertain what actions we have taken in relation to your personal data.

5. Rights of Data Subjects

As a data subject, you have rights under personal data protection law. We attach great importance to supporting and facilitating the exercise of these rights, as follows:

  • Right to be informed: We will provide a Privacy Notice that clearly specifies the purposes of collecting, using and disclosing personal data.
  • Right to withdraw consent: You may withdraw the consent you previously gave to EECO at any time.
  • Right of access: You may request access to and a copy of your personal data, or disclosure of how personal data obtained without your consent was acquired.
  • Right to rectification: You may request correction of inaccurate personal data so that it is accurate, up to date and not misleading.
  • Right to erasure or destruction of personal data, or to have it rendered incapable of identifying the data subject.
  • Right to receive or transfer personal data: Where our data systems support formats that can be read or commonly used by automated tools or equipment, and the personal data can be used or disclosed by automated means, you may request a copy of your personal data, request its transfer to another data controller by automated means, and request receipt of the personal data so sent or transferred.
  • Right to request restriction of the use of personal data.
  • Right to object to the collection, use or disclosure of personal data.
  • Right to lodge a complaint with officials or the authority responsible for supervising personal data protection.


In certain cases, we may refuse or be unable to fulfil a request to exercise the above rights where there are lawful grounds to do so; where the action is for a purpose, or in circumstances, requiring compliance with a law or court order; where it may adversely affect or harm the rights or freedoms of the data subject or another person; or where your personal data has been rendered anonymous or stripped of characteristics that could identify you.

If you, as a data subject, successor in title, heir, legal representative, custodian or curator, as applicable, wish to exercise these rights, you may contact us using the contact details below. We may also retain a record of your request as evidence.

6. Personal Data Security Measures

We recognize the trust you place in us by providing us with important information. Personal data protection law requires EECO, as a data controller, to put in place security measures and management arrangements to ensure that such data is protected and available for access and review by data subjects.

We have implemented personal data security measures under EECO’s Information Security Policy and practices to prevent the loss of personal data and unauthorized access, destruction, use, alteration, modification or disclosure.

7. Data Storage and Transfer

We store, use and process your personal data on cloud systems located in Thailand. In some cases, however, transfers for storage or processing may need to take place across locations or countries, or your personal data may need to be sent or transferred abroad for the purposes of providing services to you. We will always verify that such transfers are secure, that recipients have data safeguards and protection measures meeting the standards prescribed by law, and that such sending or transfer complies with the rules prescribed by the Personal Data Protection Committee for the protection of personal data sent or transferred abroad. Exceptions apply where EECO is required by law to send or transfer personal data abroad, or where we have informed you and obtained your consent in a case where the destination country has inadequate personal data protection standards, in accordance with the list of countries announced by the Personal Data Protection Committee.

8. Personal Data Retention Period

We will retain your personal data only for as long as it remains necessary for the purposes of collection and as required by law.

  • CCTV images: 90 days.
  • Personal data relating to the integrity and transparency assessment of government agencies: 1 year.
  • Electronic log data: 90 days.
  • Personal data relating to participation in activities and public relations information may be retained until EECO’s statutory functions have ended.
  • Data required for legal, accounting, monitoring and verification activities: 10 years.
  • Data relating to participation in EECO meetings: 10 years from the end of each meeting.


However, we may need to retain your personal data beyond the periods specified above if we are notified of, or believe in good faith that there may have been, a breach of EECO’s terms of service, a violation of law or a dispute, and investigation, inquiry or the gathering of evidence for legal proceedings is necessary. We will retain your personal data for as long as necessary until the process is completed, or for the period prescribed by the relevant law.

At the end of the applicable retention period, we will erase or destroy the personal data, or render it incapable of identifying the data subject.

9. Review and Amendment of This Notice

We may update, amend or change this Notice from time to time to ensure that its contents remain appropriate, up to date and consistent with personal data protection law and other applicable laws. If we update, amend or change this Notice, we will display the latest version and notify you through appropriate channels. We recommend that you read and review this Notice regularly, particularly before submitting personal data through our services.

10. Contact Details

If you have any questions, suggestions, comments or feedback, require further information about this Notice, or wish to exercise your rights as a data subject, please contact us at:

Data Protection Officer (DPO)

  • Email: pdpa@eeco.or.th
  • Telephone: +66 2033 8000 
  • Eastern Economic Corridor Office (EECO)
    25th Floor, NT Bangrak Building, Charoen Krung Road, Bang Rak, Bangkok 10500, Thailand
โลโก้ EEC เขตพัฒนาพิเศษภาคตะวันออก เชื่อมโลก ให้ไทยแล่น
ขนาดตัวอักษร
โลโก้ EEC เขตพัฒนาพิเศษภาคตะวันออก เชื่อมโลก ให้ไทยแล่น
ขนาดตัวอักษร