1. Our roles: controller and processor

For the Customer's own account and billing data, Naya People is the data controller. For the employee personal data that a Customer uploads to run HR, approvals, tickets, contracts and assets, the Customer is the controller and Naya People acts as the Customer's data processor, handling that data only on the Customer's instructions.

2. Information we collect

Depending on how the Service is used, this may include:

• Account data — names, work email, phone number and role of the users you create.
• Employee data you upload — profiles, employment records, time and leave, approvals, tickets, contracts and assets.
• Usage and device data — log-ins, IP address, browser/device details and actions in the app.
• Billing data — the information needed to invoice your subscription.

3. How we use personal data

We use personal data to provide, secure and support the Service, to authenticate users, to process billing, to communicate about the Service, and to meet legal obligations. Employee data is processed only to deliver the modules the Customer has configured.

4. Legal basis (PDPA)

We rely on the lawful bases under the PDPA — performance of a contract, our legitimate interests in running and securing the Service, consent where required, and compliance with law. The Customer is responsible for having a lawful basis for the employee data it uploads.

5. Sharing and disclosure

We do not sell personal data. We share it only with:

• Sub-processors that host and support the Service (e.g. cloud infrastructure), under contract.
• Professional advisers, or authorities where required by law.
• A successor in the event of a corporate reorganisation, subject to this policy.

6. Data retention

We keep personal data for as long as the account is active and as needed to provide the Service. After termination we make Customer Data available for export for a reasonable period, then delete or anonymise it unless the law requires longer retention.

7. Data security

We apply appropriate technical and organisational measures — including access controls, encryption in transit, and database-level tenant isolation — to protect personal data against unauthorised access, loss or misuse.

8. Your rights under the PDPA

Subject to the PDPA, data subjects may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. Where Naya People acts as processor, we forward such requests to the relevant Customer (controller) or assist the Customer in responding.

9. Cookies

The web application uses strictly necessary cookies to keep you signed in and secure. We do not use them for advertising. You can manage cookies in your browser, though disabling essential cookies may break sign-in.

10. International data transfers

Data is primarily processed in Thailand. Where a sub-processor operates outside Thailand, we put appropriate safeguards in place as required by the PDPA.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, for material changes, provide reasonable notice.

12. Contact us

For privacy questions or to exercise your rights, contact Naya People Co., Ltd. using the details below. This policy is governed by the laws of Thailand.