GRI 103-2
Code of Ethics on Confidentiality, Safeguarding, and Use of Inside Information

However, the safeguarding and confidentiality of the company's information have been integrated into a part of corporate risk management and regulation with which all employees must strictly comply. The company has disciplinary actions in case of non-compliance with the corporate governance principles and code of conduct.

Corporate Governance Manual and Code of Conduct

The company has implemented strict supervision, protection and safeguarding of customer data, which is considered one of the agreement terms of the purchase agreements, along with the asset management plan, confidential information protection and use of company data. In addition, for the personal information of directors, executives or employees of customers, GPSC has established the use of privacy policy covering companies in the group and partners for strict compliance to protect the personal data and comply with the Personal Data Protection Act B.E. 2562 (PDPA).

In addition, GPSC internal audit department had conducted the audit of data privacy collection process to ensure the company is preparing to act in accordance with PDPA. The scope of audit covers the topics are following:

  1. Personal Data Processing Risk Assessment
  2. Data Governance and Compliance Management consist of responsible person determination, policy communication plan, process and measures for law implementation.
  3. Breach Response

In this regard, GPSC Group had not encountered any violations of customer data and no complaints regarding customer data protection. Moreover, GPSC Group did not use a customer's personal data information to process on the other purposes beside as mentioned in the privacy policy in 2022

Privacy Policy

The company has developed the point of contact which the customers can communicate, complaint, suggest, as well as receive information on the operations of the company with ease and swiftness though these channels as follows.

02-140-4600
555/2 Energy Complex Building B, 5th Floor, Vibhavadi – Rangsit Road, Kwaeng Chatuchak, Khet Chatuchak, Bangkok 10900.
Fulfilling Customer Needs
  • Contacting through the customer relations teams.
  • Monthly meetings to receive reports of products and maintenance plan.
  • Listening to customer’s feedback.
  • Distributing and providing services to all customers in industrial sector.
  • Conducting of customer satisfaction survey at least annually.
Maintaining and Building Customer Relationship
  • Annual customer relations management activities.
  • Monthly meetings to receive reports on products and maintenance.
  • Visiting customer sites.
  • Annual seminars on production efficiency improvement
  • Leisure and sports activities
  • Seminars and visits to power plants.

Organizing Customer Relations Activities with Relevant Company Departments

GPSC places great importance on building good relationships with customers by regularly organizing customer relations activities with GPSC’s responsible parties. These activities are categorized into monthly, quarterly and yearly activities so that GPSC can correspond to the specific needs of each customer group in an appropriate and timely manner.

  • Monthly Activity – Rotating meeting that held on customer’s site and conducts on the last Wednesday of each month. The purpose of this activity is to develop sales and production planning as well as to acknowledge the short-term needs of customers.
  • Quarterly Activity – Recreational activity that provides knowledge to every level of customer’s employees.
  • Yearly Activity – Activity that focuses on related to company’s business site visit for exchanging knowledge and idea on business opportunities.

Automatic Energy Monitoring System (EnergyLens Application)

GPSC has developed a software called EnergyLens to help customers monitor their electricity and steam consumption more efficiently, while also receiving real-time results, as well as being able to analyze historical usages and other information, such as monthly expense reports, manuals for communicating with the company. All such services can be used on websites, mobile phones and tablets. This digital technology system is a powerful customer relationship management tool for analyzing and collecting critical information. This allows the company to adjust the delivery plan and manage the quantity of products produced for maximum efficiency.

Conducting Customer Satisfaction and Engagement Survey by a Third Party

For continuously improving customer relationship management, whereby the company conducts a third-party customer satisfaction survey annually in which customers can express their opinions openly and objectively. The results of this survey will reflect the extent of the ability to deliver products and management, which meet the needs of customers through the operations of the company, with seven key groups of questions, in order for the company to be able to proactively plan for managing relationships, satisfaction and engagement to more accurately meet customer expectations. The results for customer satisfaction in the past 4 years and target in 2022 are as follows:

  2019 2020 2021 2022 Target 2023
Customer satisfaction 86.3 84.29 91 95 ≥90
Coverage 100 100 100 100 100

Remark: Customer satisfaction was extended to cover Glow’s customers in 2020.

The Seven Main Groups of Questions in the Satisfaction Survey

Pre-sales & Sales Stage
Quality and Reliability of Products
Billing and Metering
Maintenance and Planned Service Outage
Customer Request and Complaint Management
Contract Management
Price of Products

The results of the survey will be reported through a meeting of the Management Committee (MC) of the company, which is chaired by the President and Chief Executive Officer. Key issues that need to be addressed are reported from each customer satisfaction survey and jointly sought to resolve each issue, complaint/ feedback from customers, in order for the relevant departments to act urgently.

Privacy Protection Management

GPSC has embedded privacy policy in group-wide risk and compliance management. In terms of risk management integration, GPSC Risk Management Policy regulates that risk assessment must take privacy policy compliance into account. In so doing, we have included the issues of customer data protection as one of the enterprise risk factors. In terms of compliance management integration, GPSC PDPA Management Guideline aims at preventing damages from the risk of non-compliance with applicable laws and regulations. GPSC Group Corporate Governance Manual and Code of Conduct states that the board of directors shall establish an information security system, including appropriate policies and procedures, to protect confidentiality, integrity, and availability of business information, including market sensitive information. The board of directors shall also monitor the adherence to confidentiality requirements by directors, executives, employees, and related outsiders (e.g., legal and financial advisers). In addition, we have applied the privacy policy to Customer Relationship Management where customer personal data is protected and complied with the Personal Data Protection Act B.E. 2562

Other Privacy Policy Risk/Compliance Management Documents:
Disciplinary Actions

GPSC requires that all employees must comply with corporate rules, guideline and practices in regards to privacy protection. In case of privacy breach where GPSC has zero tolerance, employee who violate privacy practices shall be subjected to disciplinary actions, according to GPSC and national regulations. Specifically, Human Resource Rules (chapter 5 and 6, item 2.13 in the investigation report form) prescribes that all employees must keep confidentiality of information, technology, knowledge, or any other sensitive information of the company. Any actions that violate or do not comply with the rules & regulations will follow into investigation process and receive disciplinary consideration in accordance with regulations. Similarly, GPSC’s Regulations on Information and Communication Technology Policy Standard Practice and GPSC Group Corporate Governance Manual and Code of Conduct also require that all GPSC employees who do not comply with privacy practices shall be subjected to disciplinary actions.

Disciplinary Actions-Related Document:
Privacy Policy Audit

Annually, GPSC conducts an internal audit on privacy policy compliance. The internal audit examined corporate-wide compliance with Personal Data Protection Act B.E. 2562, on four different aspects: Protection, Data Collection, Data Disclosure, and Data Rights. The results showed that the entire GPSC operations complied with Personal Data Protection Act B.E. 2562.

Compliance Procurement Commercial HR QSHE Goverment
Relations
Investor
Relations
Company
Secretary
Protection
Data Collection
Data Disclosure
Data Rights DPA
In Progress
DPA
In Progress
Privacy Policy Internal Audit-Related Document
  • Internal Audit Results
Privacy Policy External Audit

In accordance with the Personal Data Protection Act B.E. 2562, GPSC plans to conduct a third party assessment to verify our privacy policy compliance. We have come to conclusion that in the years to come, GPSC, together with third party, conduct a study on business activities that prone to privacy policy violation. The results of the study will inform GPSC on ways to improvement and will be integrated into training session for all employees.

Revised as of February 2022

The above content has been produced in accordance with the Global Reporting Initiative (GRI Standards) sustainability reporting standard, validated by third parties and provides limited assurance of reporting information (Limited assurance).