Legal document
Privacy policy
What we collect, on what lawful basis, for how long, who receives it, and how you stay in control — under the Personal Data Protection Act B.E. 2562.
- Effective from
- September 2, 2026
- Last revised
- September 2, 2026
- Version
- 2026-01-01
1. Controller and contact
JobDee is the data controller under the Personal Data Protection Act B.E. 2562 (PDPA).
Data protection contact: แบบฟอร์มติดต่อบนเว็บไซต์ — we reply within 7 days.
2. What we collect and on what basis
| Category | Examples | Lawful basis | Required |
|---|---|---|---|
| Account data | Name, email, hashed password | Contract | Yes |
| Contact channels | Phone, LINE ID | Consent | No |
| Freelancer profile | Headline, bio, skills, hourly rate, portfolio link | Contract | Required to apply |
| Postings and applications | Text, quoted price, attachments | Contract | Yes |
| Location | Selected province | Contract | No |
| Security logs | IP, user agent, login times | Legitimate interest | Yes |
| Action logs | Posting approvals, application status changes | Legitimate interest | Yes |
| Consent records | Cookie choices, timestamp, policy version | Legal obligation | Yes |
| Analytics cookies | Aggregate usage statistics | Consent | No |
We do not collect sensitive data under section 26 — ethnicity, religion, health or biometric data — and we ask that you keep such information out of profiles and applications.
3. Purposes of processing
3.1 Operating the platform: creating accounts, displaying postings, sending and receiving applications.
3.2 Authenticating you and keeping accounts secure.
3.3 Reviewing postings and preventing fraud.
3.4 Sending service email — new applications, review outcomes, password resets.
3.5 Improving the product using aggregate statistics that do not identify individuals.
We do not use your data for automated decisions with legal effect. Approving or rejecting a posting is always a human decision.
4. Disclosure
4.1 A client who selects your application sees your email, plus phone and LINE ID if you provided them. Before the "accepted" status, that data never leaves the server.
4.2 Public by design — your name, headline, bio, skills, rate and province appear on your public profile.
4.3 Processors we use — hosting and email providers, under contracts imposing the protection duties required by section 40.
4.4 Authorities — on a valid court order or lawful warrant. We verify every request before disclosing anything.
We do not sell your personal data, and we pass nothing to third parties for marketing.
5. Transfers outside Thailand
5.1 Primary servers are located in Southeast Asia.
5.2 Where a provider processes data outside Thailand, we comply with section 28 using standard contractual clauses that impose equivalent safeguards.
6. Retention
| Data | How long |
|---|---|
| Account and profile | While the account is active |
| After account deletion | Personal data erased within 30 days |
| Postings and applications | 12 months after the job closes, then anonymised |
| Application attachments | Deleted with the application |
| Session records | 30 days |
| Security and fraud logs | 12 months |
| Consent records | 3 years, as the law requires them to be provable |
| Administrator action logs | 3 years |
7. Your rights
Under Chapter 3 of the PDPA you have the right to:
7.1 Access and obtain a copy — the "Download my data" button in settings returns a JSON file immediately.
7.2 Rectification — edit it yourself on the profile page.
7.3 Erasure — the delete-account button in settings; completed within 30 days.
7.4 Object to processing — write to us through the contact form specifying what you object to.
7.5 Restriction of processing — while the accuracy of data is being verified.
7.6 Portability in machine-readable form — the same JSON file as 7.1.
7.7 Withdraw consent — on the consent page. Withdrawal does not affect processing already carried out lawfully.
Exercising these rights is free. We respond within 30 days; for complex requests we may extend and will explain why.
8. Cookies
Full detail is in the cookie policy. In short: non-essential cookies do not run until you press accept, and scrolling the page is not consent.
9. Security measures
9.1 Passwords are stored as bcrypt hashes, never as plain text.
9.2 Password reset tokens are stored as SHA-256 hashes, single-use, and expire after one hour.
9.3 Traffic is encrypted with TLS.
9.4 Application attachments are accessible only to the sender, the client who owns the posting, and administrators.
9.5 Team access to the database is limited to what is necessary and is logged.
10. Minors
This service is for people aged 18 and over. If we discover we have inadvertently collected a minor's data we delete it immediately. Parents or guardians who believe a child has given us data should write to us through the contact form.
11. Changes to this policy
11.1 Material changes are announced by email and on the website.
11.2 When the policy version changes, existing consent is invalidated and we ask again.
12. Complaints
12.1 If you believe we have handled your data improperly, write to us through the contact form first. We reply within 7 days.
12.2 You may complain to the Personal Data Protection Committee directly, without going through us first.