The basic rules are:
Who is used for people.
For example:
Which is used for things.
For example:
That can be used for both, but we don’t really use ‘that’ for people. (The consensus is that using that for people in speech is acceptable, but not so in writing.)
For example:
If you’re interested in reading a more in-depth article on using that, which or who, Oxford Dictionaries has written this good piece.
http://blog.oxforddictionaries.com/2012/09/that-who-which/