This policy explains how personal data is collected, used and disclosed in the MAX-HRM service, on the web and in the mobile app, under Thailand's Personal Data Protection Act B.E. 2562. It has two parts, by the company's role.
| Part | Whose data | Our role |
|---|---|---|
| A | Customer companies, their contacts, and their system users | Data controller |
| B | Customer companies' employees (users of the employee app and portal) | Data processor on the employer's behalf; the employer is the controller |
Part A · Customer and contact data
A1. Data collected
- Customer contacts: name, position, email, phone number.
- Customer system users: username, email and permissions; passwords are stored with one-way hashing.
- Contract, invoicing and payment records.
- Service requests and problem reports.
A2. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the contracted service, setup and after-sales support | Contract |
| Invoices, receipts and tax documents | Legal obligation |
| Notices about the service in use, such as new versions and maintenance | Legitimate interest |
| Marketing of other products | Consent, which may be withdrawn at any time |
A3. Retention
For the term of the contract and, after it ends, for the period required by accounting and tax law, or as needed to establish or defend legal claims.
Part B · Employee data processed for the employer
We process this data only on the employer's instructions and for no other purpose.
B1. Data collected
| Category | Data | Source |
|---|---|---|
| Entered at registration | Employee code · phone number · email (optional) · national ID or passport number · date of birth · password | The employee |
| Employee record | Name · company · department · photo, and other data the employer records | The employer's HR team |
| Attendance | Date and time · in/out · scan method · scanner name · photo taken at the scan | The employer's time clocks |
| Notifications | Data needed to deliver notifications · device type label (e.g. "Chrome · Android") | The employee's device, when notifications are turned on |
B2. Face data
- The employer's time clocks may use face recognition to verify identity for attendance. This data is used for attendance and identity verification only.
- The employer obtains the employee's explicit consent before face data is used, under section 26 of the Act.
- Photos are stored encrypted, and scan photos are kept for the period the employer sets.
- We never sell face data, use it for advertising, or use it for any other purpose.
B3. Data the app does not collect
- Location (GPS).
- Face or fingerprint data used to unlock the app. Face ID and Touch ID are checked by the phone; the app only learns whether the check passed.
- Advertising, cross-app tracking or usage analytics.
- The camera is used only to scan the company's QR code; no picture is kept.
B4. Purposes
- Verify identity at registration, sign-in and password reset.
- Show employees their own attendance and work results.
- Notify employees about scans and items awaiting approval.
- Other HR operations as the employer configures.
B5. Who can see the data
- HR and approvers, as the employer configures.
- Our staff, only when needed to operate the system or resolve an issue the employer raises.
- Notifications are delivered through the browser and operating-system notification services (such as Apple's and Google's), which receive only the notification text (for example the time, number of scans and scanner name) — never the name, employee code or department.
B6. Retention and deletion
- Kept for the period the employer sets and labour law requires.
B7. Data breaches
If a personal-data breach occurs, we notify the employer without undue delay and no later than 24 hours after becoming aware of it, so the employer can meet its legal obligations in time.
Security
- Data is sent over encrypted connections (HTTPS).
- Employee names, phone numbers, emails, national ID / passport numbers, photos and scan photos are stored encrypted; passwords are stored with one-way hashing.
- Data is stored on servers protected as the law requires, with access limited to those who need it.
Rights of data subjects
Data subjects may request access, a copy, portability, correction, deletion or restriction, object to processing, withdraw consent, and complain to the Personal Data Protection Committee office.
- Employees make requests to their employer's HR team, the controller; we assist the employer in handling them.
- Customers and contacts make requests to the email below.
A request may be refused or met in part where the law requires the data to be kept, such as employment records under the Labour Protection Act; the reason will be given.
Cookies
The app and the employee portal use only the cookies needed for sign-in, and no advertising or analytics cookies or tools.
Contact
D-SMART SOLUTION COMPANY LIMITED
88 Soi Pracha Uthit 75, Pracha Uthit Road, Thung Khru, Bangkok 10140, Thailand
Personal data: privacy@d-smart.co.th
Phone: +66 2 106 4900
Changes
Material changes will be posted on this page with their effective date and sent to customers through their registered contacts.