Privacy Policy
Draft version 0.1 · Last updated 12 October 2026 · Pending review by Thai counsel before launch
In short. If you are an employee, your employer decides what data about you goes into Pramdesk and why; we process it on their behalf. Contact your employer first about your data. We keep payroll data in Thailand, encrypt the most sensitive fields, never sell it, and do not use advertising or tracking cookies.
1. Who is responsible for your data
This policy follows Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA").
| Data | Data controller | Our role |
|---|---|---|
| Employees' personal and pay data entered by a company | That company (the employer) | Data processor, acting only on the employer's instructions |
| Account data of company staff and consultants (name, email, phone, sign-in records) | [OPERATOR LEGAL NAME] | Data controller |
Operator: [OPERATOR LEGAL NAME], [REGISTERED ADDRESS]. Data protection contact: [DPO / PRIVACY EMAIL].
2. What we process
- Identity and contact: name, email, mobile number, employee code, job and branch.
- Government identifiers: Thai national ID or tax ID, social security number. Encrypted in the database.
- Pay and tax: salary, allowances, deductions, tax allowances, withholding tax, social security and provident fund amounts, bank account. Amounts and bank accounts are encrypted in the database.
- Attendance: check-in and check-out times, and location where the employer turns this on.
- Sign-in and security: sign-in method, one-time code records (stored as one-way hashes), sessions, and an audit log of who changed what.
- Company data: legal name, tax ID, branches and registration details supplied for verification.
We do not intend to process sensitive data under Section 26 of the PDPA (such as health or religion). If an employer needs to record such data, the employer is responsible for having the explicit consent or other legal basis required.
3. Why we process it
- To provide the Service to the employer: calculate pay, produce payslips and statutory and bank files, and let employees see their own records (on the employer's instructions, under its contract with us).
- To run accounts securely: sign-in, preventing fraud and abuse, and investigating incidents (our legitimate interest, and the contract with account holders).
- To verify companies before payroll is unlocked (contract and legitimate interest).
- To meet legal obligations, such as responding to lawful requests from Thai authorities.
We do not sell personal data, use it for advertising, or use employees' data to train AI models.
4. Who we share it with
- Hosting: Amazon Web Services, in the Asia Pacific (Bangkok) region. Payroll data is stored in Thailand.
- Messages: email (and, when enabled, SMS) providers deliver sign-in codes and invitations. Only the address and the message are shared.
- Single sign-on: if you choose Google or Microsoft sign-in, that provider confirms your email address to us. We receive no password.
- Your employer's users and consultants with the role that allows it. Each company sees only its own data.
- Authorities when Thai law requires us to.
Some of these providers may process limited data outside Thailand (for example, email delivery). Where that happens, we rely on the safeguards the PDPA allows, such as contractual protections.
5. How we protect it
- National IDs, pay amounts and bank accounts are encrypted field by field (AES-256-GCM) on top of encrypted storage and backups.
- Every request is tied to one company and checked against the user's role and branches.
- Company staff sign in with a password and a second factor; passwords are stored only as salted hashes.
- Access to our infrastructure needs multi-factor sign-in and is logged.
No system is perfectly secure. If a breach affects personal data, we tell the affected employers without delay so they can notify the Personal Data Protection Committee within 72 hours, as the PDPA requires.
6. How long we keep it
| Data | Kept for |
|---|---|
| Payroll records, tax and social security filings | At least 5 years and up to 10, as Thai tax and accounting law requires, unless the employer instructs otherwise within the law |
| Former employees' profiles | Until the payroll retention period ends |
| Audit log | At least as long as the data it describes |
| Backups | Up to 14 days, rolling |
| Data of a closed company account | Deleted after the 30-day export period, except what the law requires us to keep |
7. Your rights
Under the PDPA you may ask for access to and a copy of your data, correction, deletion or restriction, data portability, and object to processing, and you may withdraw consent where processing relies on it. Some rights are limited where the law requires the data to be kept (for example, tax records).
- Employees: send requests to your employer, which controls your data. We help your employer answer them.
- Company staff and consultants: write to [DPO / PRIVACY EMAIL]. We answer within 30 days.
You may also complain to the Office of the Personal Data Protection Committee (PDPC), Thailand.
8. Cookies and local storage
We do not use advertising or analytics cookies. The web app keeps your session token in your browser's session storage (cleared when you close the tab) and remembers your language choice. The mobile app keeps your session in the phone's secure storage.
9. Children
The Service is for employers. Employers who employ people under 18 are responsible for any additional legal requirements that apply.
10. Changes
We will post updates here with a new date and notify account owners of material changes.