Privacy Policy
Effective date: 26 May 2026
Introduction
Thai.do ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard the personal data of job seekers, employers, freelance service providers, and visitors who use the Thai.do platform. This policy is drafted in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the "PDPA") and other applicable laws. By using Thai.do, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please discontinue use of the platform.
Data Controller
For the purposes of the PDPA, Thai.do is the data controller responsible for the personal data collected through our website, mobile applications, and related services. You may contact our data protection team at privacy@thai.do for any inquiries regarding the processing of your personal data, the exercise of your rights, or this policy. Where applicable, we may appoint a Data Protection Officer (DPO) whose contact details will be published on this page once designated. Service providers that process personal data on our behalf act as data processors under our written instructions.
Categories of Personal Data We Collect
Depending on how you interact with Thai.do, we may collect the following categories of personal data: (a) identity and contact data such as full name, email address, telephone number, date of birth, gender, and profile photograph; (b) professional data such as résumé content, employment history, education, skills, salary expectations, portfolio links, and references; (c) account and authentication data such as login credentials, verification codes, and account settings; (d) transactional data related to job applications, service orders, invoices, and payments; (e) technical data such as IP address, device identifiers, browser type, operating system, and language preferences; and (f) usage data such as pages viewed, searches performed, and interactions with employers or freelancers. We do not intentionally collect sensitive personal data unless you provide it voluntarily.
Sources of Personal Data
We obtain personal data from several sources. The majority comes directly from you when you register an account, complete your profile, upload a résumé, post a job, place a service order, contact our support team, or otherwise interact with the platform. We may also receive data from third parties with your authorization, for example when you sign in using a social or single-sign-on provider, when an employer invites you to apply, or when a verified partner refers a candidate. Finally, we automatically collect technical and usage data through cookies, log files, and similar technologies when you visit Thai.do.
Purposes of Processing
We process personal data for the following purposes: to create and manage your account; to match job seekers with suitable vacancies and employers with suitable candidates; to facilitate freelance service orders, communications, and payments between parties; to verify your identity and prevent fraud, abuse, and unauthorized access; to send transactional notifications such as verification codes, application status updates, and security alerts; to provide customer support and respond to your inquiries; to perform internal analytics and improve the quality, safety, and relevance of our services; to deliver marketing and promotional messages where you have given consent; and to comply with applicable laws, regulations, and lawful requests from competent authorities.
Legal Bases for Processing
We rely on one or more of the following legal bases under the PDPA when processing your personal data: (a) performance of a contract to which you are a party, such as providing the platform services you have requested; (b) compliance with a legal obligation imposed on Thai.do; (c) our legitimate interests in operating, securing, and improving the platform, provided such interests are not overridden by your fundamental rights; (d) your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing; and (e) vital interest or public interest where permitted by law. Where we rely on consent, we will obtain it clearly and separately and provide an easy mechanism to withdraw it.
Disclosure to Third Parties
We do not sell your personal data. We may disclose personal data to the following recipients only to the extent necessary: employers who receive applications and résumés you submit through Thai.do; job seekers and freelancers with whom you choose to communicate; service providers acting as our data processors, including cloud hosting, email delivery, payment processing, analytics, identity verification, and customer support vendors; professional advisors such as auditors, lawyers, and accountants; competent authorities, regulators, courts, and law enforcement agencies when required by Thai law or to protect our legal rights; and acquirers or successors in the event of a merger, acquisition, reorganization, or sale of all or part of our business. All processors are bound by confidentiality and data protection obligations.
Cross-Border Data Transfer
Thai.do operates primarily in Thailand, but some of our service providers and infrastructure are located outside the Kingdom. When we transfer personal data abroad, we ensure that the destination country provides an adequate level of data protection as recognized by the Personal Data Protection Committee (PDPC), or we put in place appropriate safeguards such as standard contractual clauses, binding corporate rules, or your explicit consent in accordance with Sections 28 and 29 of the PDPA. You may request information about the specific safeguards applied to transfers of your data by contacting privacy@thai.do.
Cookies and Similar Technologies
Thai.do uses cookies, local storage, and similar technologies to keep you signed in, remember your language and regional preferences, measure how the platform is used, and deliver relevant content. Some cookies are strictly necessary for the platform to function and cannot be disabled. Others are used for analytics, performance, or marketing and require your consent. You can manage non-essential cookies through the cookie banner displayed on your first visit or by adjusting your browser settings. For a detailed description of each cookie we set, please refer to our Cookie Policy.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, tax, or reporting requirements. Active account data is retained while your account remains open. If you delete your account, we soft-delete your profile immediately and permanently erase associated personal data within 30 days, except where longer retention is required by law (for example, transaction and tax records are kept for up to 10 years under Thai law). Anonymized and aggregated data, which can no longer identify you, may be retained for statistical and research purposes without time limitation.
Your Rights as a Data Subject
Under the PDPA you have the following rights regarding your personal data: the right to be informed about how it is processed; the right of access and to obtain a copy; the right to rectification of inaccurate or incomplete data; the right to erasure or anonymization when no longer necessary; the right to restrict processing in certain circumstances; the right to object to processing, including for direct marketing; the right to data portability in a structured, commonly used, and machine-readable format; the right to withdraw consent at any time; and the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand. You may exercise most of these rights directly through your account settings, or by writing to privacy@thai.do. We will respond within 30 days of receiving a verified request.
Security Measures
We implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful access, loss, alteration, disclosure, or destruction. These measures include encryption in transit via HTTPS, encryption at rest for sensitive fields, secure password hashing with bcrypt, short-lived single-use verification codes that expire after 30 minutes, role-based access controls, audit logging, regular vulnerability scanning, and staff training on data protection. Despite these safeguards, no system is completely secure; we therefore encourage you to use a strong unique password and to notify us immediately at privacy@thai.do if you suspect any compromise of your account.
Children's Privacy
Thai.do is not intended for children under the age of 20, which is the age of legal majority in Thailand. We do not knowingly collect personal data from children under 20 without the verifiable consent of a parent or legal guardian. Where local law permits a lower minimum age for using online services, an applicant must still meet the minimum age to register for employment under the Labour Protection Act B.E. 2541. If you believe that we have collected personal data from a child without appropriate consent, please contact privacy@thai.do and we will take prompt steps to delete the data.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you through the platform or by email at least 30 days before the changes take effect. We encourage you to review this policy periodically. Your continued use of Thai.do after the effective date constitutes your acknowledgment of the updated policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact our data protection team at privacy@thai.do. You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand at the Ministry of Digital Economy and Society if you believe that our processing of your personal data does not comply with the PDPA.