Privacy Policy

1. Personal data we collect

The Company may collect the following personal data:

• Identity and contact data, such as name, job title, organization, email address, phone number, and address
• Account data, such as username, sign-in information, and usage preferences
• Service data, such as documents or data users bring into the services, transaction history, and activity logs
• Payment data, such as tax invoice details and payment history (the Company does not store credit card numbers directly — payments are processed by certified payment providers)
• Technical data, such as IP address, browser type, operating system, cookies, and access logs

2. Purposes and legal bases of processing

The Company collects, uses, and discloses personal data for the following purposes:

• To deliver services under contract — creating and maintaining user accounts, providing the software services, offering support, and billing (contractual basis)
• To comply with the law — such as tax law, electronic transactions law, and lawful orders of government agencies (legal obligation basis)
• For the Company's legitimate interests — such as securing our systems, preventing fraud, and analyzing and improving the services (legitimate interest basis)
• For marketing communications, such as product and service updates — carried out only with consent, which the data subject may withdraw at any time (consent basis)

3. Disclosure of personal data

The Company does not sell personal data to third parties, and discloses data only as necessary to the following recipients:

• Third-party service providers (data processors) engaged by the Company, such as cloud providers, payment providers, and email delivery providers, under data processing agreements
• Government or regulatory authorities, where disclosure is required by law or by a lawful order
• The Company's professional advisers, such as auditors or legal counsel, to the extent necessary for their duties

Where personal data is transferred abroad, the Company will ensure the destination country or recipient provides an adequate standard of data protection as required by law.

4. Cookies and similar technologies

The Company's website and services use cookies and similar technologies to make the website function correctly, remember user preferences, and analyze usage to improve the services. Users can configure their browser to refuse non-essential cookies, which may affect some functionality.

5. Data retention

The Company retains personal data only as long as necessary for the purposes of processing, throughout the service relationship, and thereafter for the periods required by applicable law, such as accounting and tax law. After that, the Company will delete, destroy, or anonymize the data.

6. Security measures

The Company maintains appropriate organizational and technical security measures, such as data encryption, access control, and system monitoring, and operates an Information Security Management System (ISMS) aligned with the international standard ISO/IEC 27001.

7. Rights of data subjects

Data subjects have the following rights under the PDPA:

• The right to access and obtain a copy of their personal data
• The right to have their data corrected and kept up to date
• The right to have their data deleted or destroyed
• The right to restrict the use of their data
• The right to object to the processing of their data
• The right to receive their data, or have it transferred, in electronic form (data portability)
• The right to withdraw consent at any time, without affecting processing already carried out
• The right to lodge a complaint with the Personal Data Protection Committee if they believe the Company has violated the law

Data subjects may exercise these rights through the contact channels below. The Company will consider and act on requests within the period required by law.

8. Reviews and updates to this policy

The Company may review and update this policy from time to time to keep it aligned with the law and its business. Updated versions will be published on this page with the latest revision date.

Data Protection Officer (DPO)

For questions about this policy, or to exercise your rights as a data subject, please contact:

Mr. Krit Sukavachana

Data Protection Officer

Email

dpo@frevation.com

Phone

02-107-0999

Address

Frevation Company Limited, 682 Moo 1, Sukhaphiban 1 Road, Borabue, Maha Sarakham 44130, Thailand