🔒 นโยบายความเป็นส่วนตัว PDPA

🇬🇧1. Introduction and Scope

The company providing ConstructQ services (hereinafter referred to as the “Company”) recognizes the importance of protecting your personal data and has prepared this Privacy Policy to help you understand how we collect, use, disclose, and protect your personal data.

This policy complies with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other related laws of the Kingdom of Thailand.

This policy covers the processing of personal data of users of the ConstructQ platform on both Web Application and Mobile Application, including registered users, visitors, subscribers, and individuals whose names appear in data uploaded by users.

🇬🇧2. Definitions under PDPA

“Personal Data” means data about a person that can identify such person, directly or indirectly, but not including data of a deceased person specifically.

“Sensitive Personal Data” means personal data pertaining to racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, as defined in Section 26 of the PDPA.

“Data Controller” means the Company that has authority to make decisions regarding the collection, use, or disclosure of personal data.

“Data Processor” means a natural or legal person who processes personal data on behalf of the Data Controller, such as cloud providers, Omise, SlipOK, Keycloak.

“Data Subject” means a person to whom the personal data pertains.

“Processing” means the collection, use, disclosure, storage, modification, alteration, transmission, transfer, deletion, or destruction of personal data.

🇬🇧3. Data Controller and Data Protection Officer (DPO)

Data Controller:
The company providing ConstructQ services
Address: [Company address to be specified upon company registration completion]
Email: info@constructq.co.th
Phone: 02-XXX-XXXX

Data Protection Officer (DPO):
Contact DPO at: dpo@constructq.co.th
Phone: 02-XXX-XXXX (ext. 9)
Office hours: Monday-Friday, 9:00-18:00

You may contact the DPO to inquire, exercise your rights, or file complaints regarding the processing of personal data.

🇬🇧4. Categories of Personal Data Collected

The Company collects personal data as follows:

4.1 Information you provide directly:
(a) Account data: name, email, phone number, password (encrypted)
(b) Profile data: profile picture, position, department
(c) Company data: company name, 13-digit taxpayer ID, address, contact person
(d) Payment data: credit card (via Omise · not stored by us), PromptPay, bank account, tax invoice
(e) User data in the system: information of employees/contractors you add to the system

4.2 Data collected automatically when you use the service:
(a) Access logs: IP address, User Agent, login time, system events
(b) Device data: device type, OS, browser, screen resolution
(c) GPS data (Mobile App only · with consent): coordinates attached to inspection photos
(d) FCM Token: for Push Notifications
(e) Cookies and tracking technologies: per Cookie Policy

4.3 Data uploaded by users:
(a) Inspection photos (may contain persons in the image)
(b) Inspection documents, checklists, NCRs
(c) Digital signatures
(d) Comments on inspection tasks

4.4 Data from third-party providers:
(a) SSO/OAuth Login: name, email, profile picture from Google · LINE (only data you consent to)
(b) Omise: credit card token (token only, not card number)
(c) SlipOK: slip verification results

🇬🇧5. Legal Basis for Processing

The Company processes your personal data based on the following legal bases under Section 24 of the PDPA:

5.1 Contractual Necessity · Section 24(3)
To provide services to you as specified in the Terms & Conditions, such as account creation, processing subscription orders, sending tax invoices.

5.2 Legal Obligation · Section 24(6)
To comply with applicable laws, such as the Revenue Code (retaining tax invoices for 5 years), anti-money laundering, and orders from competent authorities.

5.3 Legitimate Interest · Section 24(5)
For the legitimate interests of the Company or third parties, taking into account your rights and freedoms, such as fraud prevention, system security, service improvement, and Audit Log recording.

5.4 Consent · Section 24(1)
When you give specific consent, such as for marketing emails, enabling GPS on Mobile, non-essential cookies, and SSO connection with Google/LINE.

5.5 Vital Interest · Section 24(2)
In urgent cases necessary to prevent harm to a person's life, body, or health.

5.6 Public Interest · Section 24(4)
To carry out missions for the public interest (when the Company is so assigned).

🇬🇧6. Purposes of Processing

The Company processes your personal data for the following purposes:

6.1 Service Provision: Account creation and management, authentication, providing services per your subscribed Package, storing and processing inspection data.

6.2 Payment and Billing: Processing payments via Omise/PromptPay, issuing tax invoices, tracking payments, managing subscriptions.

6.3 Communication and Support: Sending service notifications, answering inquiries, alerting on system activities, sending email verifications.

6.4 Security: Detecting and preventing fraud, preventing unauthorized access, recording Audit Logs (immutable), responding to security incidents.

6.5 Legal Compliance: Retaining tax invoices for 5 years per the Revenue Code, responding to court orders and government agency requests.

6.6 Service Improvement: Analyzing anonymized usage, A/B testing, developing new features.

6.7 Marketing (consent required): Sending promotional emails, product news. You may unsubscribe at any time.

🇬🇧7. Sensitive Personal Data

The Company does not intentionally collect Sensitive Personal Data under Section 26 of the PDPA (such as race, religion, political opinions, health information, etc.).

However, if a user uploads sensitive personal data to the system (e.g., photos that may show physical conditions), the user is responsible for obtaining consent from the data subject prior to upload.

In cases where the Company must use Biometric Data (such as Face ID, Touch ID, fingerprint) for login in the Mobile App, such data is processed on-device only and is not transmitted to the Company's servers.

🇬🇧8. Disclosure to Third Parties

The Company may disclose your personal data to third parties in the following cases:

8.1 Service Providers (Data Processors):
(a) Cloud Provider: AWS, GCP, or equivalent (for data storage in Thailand)
(b) Omise: Payment processor · The Company sends tokens only, not credit card numbers
(c) SlipOK: Payment slip verification provider
(d) Keycloak: Identity Management system provider
(e) MinIO: Object Storage provider
(f) Firebase (Google): Push Notification provider
(g) SMTP Email Provider: Postmark/SES for sending emails

8.2 Government Agencies and Legal Authorities: When required by law, court orders, or orders of competent authorities, such as the Revenue Department, the Personal Data Protection Committee (PDPC), the courts.

8.3 Professional Advisors: Lawyers, accountants, auditors, when necessary to protect the Company's rights.

8.4 Mergers and Acquisitions: In case of merger, acquisition, or asset sale, the Company will notify you in advance before transferring data.

The Company has contracts with all Data Processors to ensure data protection meets PDPA standards.

🇬🇧9. Cross-Border Data Transfer

The Company may transfer your personal data internationally when using cloud or SaaS providers with servers located outside Thailand.

Cross-border data transfers comply with Sections 28-29 of the PDPA by:
(a) The destination country must have adequate data protection standards as determined by the Personal Data Protection Committee
(b) Adequate safeguards are in place, such as Standard Contractual Clauses (SCC) or Binding Corporate Rules (BCR)
(c) Explicit consent has been obtained from you
(d) Necessary for the performance of the contract

Currently, the Company primarily stores data within Thailand, using Cloud Providers with Data Centers located in Thailand.

🇬🇧10. Data Retention Period

The Company retains your personal data only as long as necessary for the processing purposes, as follows:

10.1 Account Data: Throughout your use of the service + 30-day Grace Period after cancellation, before permanent deletion.

10.2 Tax Invoices and Accounting Documents: 5 years as required by Revenue Code Section 87/3 (even after account cancellation).

10.3 Audit Logs: 2 years for security audits and legal compliance.

10.4 Payment Data (credit card token): Per Omise policy · The Company does not store actual card numbers.

10.5 Marketing Data (from consent): Until you withdraw consent.

10.6 User Data in the System: Throughout the period the user retains the data · automatically deleted when the account is deleted.

After the retention period, the Company will securely delete or anonymize the data.

🇬🇧11. Security Measures

The Company implements industry-standard security measures to protect your personal data:

11.1 Technical Measures:
(a) Encryption in transit: TLS 1.3
(b) Encryption at rest: AES-256
(c) Role-Based Access Control (RBAC) · access limited by role
(d) Two-Factor Authentication (2FA) · TOTP
(e) Immutable Audit Logs · using database triggers to prevent UPDATE/DELETE
(f) Rate Limiting · Brute-Force Protection
(g) Web Application Firewall (WAF)
(h) Daily backups + Disaster Recovery Plan

11.2 Organizational Measures:
(a) Security and personal data protection policies
(b) PDPA and data security training for employees
(c) Non-Disclosure Agreements (NDAs) with employees and partners
(d) Access control based on the Least Privilege principle
(e) Periodic security audits and assessments

11.3 Physical Measures:
(a) Cloud Providers certified ISO 27001 · SOC 2
(b) Data Centers with access control

However, no system is completely secure. The Company will notify you promptly in case of a data breach.

🇬🇧12. Data Subject Rights

Under the PDPA, you have the following rights:

12.1 Right of Access · Section 30
You have the right to access and request copies of your personal data held by the Company.

12.2 Right to Rectification · Section 35
You have the right to request correction of inaccurate, incomplete, or outdated data.

12.3 Right to Erasure (Right to be Forgotten) · Section 33
You have the right to request deletion of your data, except where retention is required by law (e.g., tax invoices for 5 years).

12.4 Right to Restriction · Section 34
You have the right to request the Company to restrict use of your data in legally specified cases.

12.5 Right to Object · Section 32
You have the right to object to the collection, use, or disclosure of your data in certain cases, such as processing for marketing.

12.6 Right to Data Portability · Section 31
You have the right to receive a copy of your data in a machine-readable format and transfer it to another data controller.

12.7 Right to Withdraw Consent · Section 19
You have the right to withdraw any consent given to the Company at any time. Withdrawal does not affect processing that occurred prior to withdrawal.

12.8 Right to Lodge a Complaint · Section 73
You have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) if the Company violates the PDPA.
PDPC Address: 120 Moo 3, 7th Floor, Ratthaprasasanabhakti Building, Government Complex Commemorating His Majesty The King's 80th Birthday Anniversary, 5th December B.E. 2550, Chaeng Watthana Road, Thung Song Hong Sub-district, Lak Si District, Bangkok 10210
Website: https://www.pdpc.or.th

How to exercise your rights: Contact the DPO at dpo@constructq.co.th or via system settings. The Company will respond within 30 days of receiving your request.

🇬🇧13. Cookies and Tracking Technologies

The Company uses Cookies and similar technologies to remember preferences and enhance your user experience:

13.1 Strictly Necessary Cookies: Required for system functionality, such as Session ID, CSRF Token, Authentication. No consent required.

13.2 Functional Cookies: Remember settings such as language, theme, selected package. Based on Section 24(5) Legitimate Interest.

13.3 Analytics Cookies: Used for usage analysis (e.g., Google Analytics, if used). Consent required.

13.4 Marketing Cookies: Used to display relevant advertisements. Consent required.

You can manage Cookies via the Cookie Banner displayed on first access or through your browser settings.

🇬🇧14. Children's Data

ConstructQ services are intended for legal entities and adults (age ≥ 20).

The Company does not knowingly collect personal data of persons under 20 years of age. If we discover such data was collected unintentionally, the Company will delete it immediately.

If you are a parent and discover that your child has provided data to the Company, please contact the DPO at dpo@constructq.co.th.

🇬🇧15. Data Breach Notification

In the event of a personal data breach, the Company will comply with Section 37(4) of the PDPA as follows:

15.1 Notification to PDPC: Within 72 hours of becoming aware of the breach, when the breach poses a risk to the rights and freedoms of individuals.

15.2 Notification to Data Subjects: Without delay, when the breach poses a high risk to the rights and freedoms of individuals, via email and in-system notifications.

15.3 Information Provided: Nature of the breach, type and quantity of data affected, possible impacts, measures taken by the Company to remediate, DPO contact channels.

15.4 Records: The Company will record every breach incident as evidence.

🇬🇧16. Changes to Privacy Policy

The Company may update this Privacy Policy from time to time to comply with changes in laws, practices, or services.

The Company will notify you of changes via email or in-system notifications at least 30 days before changes take effect.

If changes significantly affect your rights, the Company will request renewed consent.

The history of policy changes is shown in the Change Log section.

🇬🇧17. Contact and Complaints

General Contact:
📧 Email: info@constructq.co.th
☎️ Phone: 02-XXX-XXXX (Monday-Friday, 9:00-18:00)

Data Protection Officer (DPO) Contact:
📧 Email: dpo@constructq.co.th
☎️ Phone: 02-XXX-XXXX (ext. 9)

Exercise PDPA Rights:
📧 Email: privacy@constructq.co.th
Or via system settings (Profile menu → Privacy → Manage Rights)

Complaints to PDPC (if the Company violates PDPA):
📧 Email: pdpc@mdes.go.th
🌐 Website: https://www.pdpc.or.th
📍 Address: 120 Moo 3, 7th Floor, Ratthaprasasanabhakti Building, Government Complex, Chaeng Watthana Road, Thung Song Hong Sub-district, Lak Si District, Bangkok 10210