Privacy Policy

1. Introduction and data controller

Goodjobclubs ("the Platform", "we") values the privacy of its users. This policy explains how we collect, use, disclose and protect your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

Data controller: Prasongmegasub Co., Ltd. (บริษัท ประสงค์เมกะทรัพย์ จำกัด), the operator of Goodjobclubs
Privacy contact: [email protected]

2. Data we collect, why, and our legal basis

2.1 Data from Facebook Login or LINE Login

Data collected: with Facebook Login, your name, email address, profile picture and Facebook user ID; with LINE Login, your display name, profile picture, email address (if you allow it) and LINE user ID, as provided by that service when you authorize the app. If the email addresses from Facebook and LINE match, both are linked to the same account; otherwise, or if there is no email, they are separate accounts.
Purpose: to verify your identity, create and manage your account, and show your name/profile picture alongside the job posts you publish
Legal basis: performance of a contract (PDPA section 24(3))

2.2 Data you enter in a job post

Data collected: the contact details you choose to provide (phone number, LINE ID, Facebook link, etc.), job details, zone/area, salary/wage, and images attached to the post
Purpose: to publish the job post publicly so job seekers can contact you directly
Legal basis: explicit consent (PDPA section 19)
This data becomes public as soon as the post is published, without prior review, so please avoid entering personal information that isn't needed for job contact.

2.3 Payment data (post boosts and monthly packages)

Data the Platform stores: payment status, amount, transaction date and transaction reference (we do not store card numbers or bank account details)
Data stored by the payment provider on our behalf: all PromptPay/card payment details are processed and stored directly by Omise. The Platform does not access or store your card/bank account data itself.
Purpose: to process payments for post boosts ( from 20 THB, depending on the days chosen) and monthly packages (199 THB/month), and to keep receipts/accounting records as required by law
Legal basis: performance of a contract (section 24(3)) and compliance with law (section 24(5))

2.4 Usage and log data

Data collected: job post view counts, general server logs (such as IP address, access time, device/browser type), and reports about posts
Purpose: to analyze and improve the service, detect abuse/fraud, investigate reported posts, and keep the system secure
Legal basis: legitimate interests of the data controller (section 24(5))

2.5 Job posts our team brings over from public Facebook groups

Data collected: our team may re-publish job posts that are already public in Facebook groups, namely the post text, the post image, and the contact details the poster included in that post. A team member copies and reviews each post before publishing it. These posts appear under the Goodjobclubs team account, and we do not store the original poster's Facebook account name or profile.
Purpose: to make job posts easier for job seekers to find
Legal basis: legitimate interests (section 24(5))
The owner of such a post can ask us to remove it at any time, using the "Report this post" (แจ้งปัญหาโพสนี้) button on the post page or by email to [email protected]

3. How long we keep data

• Account data (name/email/profile picture): for as long as the account is active, and deleted or anonymized within 90 days after you ask us to close the account, unless the law requires us to keep it longer
• Job posts: shown publicly for the post's lifetime (currently 14 days), then closed/hidden from display, but kept in our system for another 180 days for audit and dispute purposes before permanent deletion
• Payment transaction data: at least 5 years, as required by accounting and tax law
• Usage logs: no more than 180 days, unless needed longer to investigate a dispute
• Post reports: until the review is complete and any period for objection has passed

4. Disclosure to third parties

We disclose your personal data to third parties only in these cases:

• Facebook/Meta Platforms, Inc. — for authentication through Facebook Login
• LY Corporation (LINE) — for authentication through LINE Login
• Omise — for processing PromptPay payments
• Google (Gemini API) — only the text of job posts our team imports under section 2.5 that have no image, to help split out the title, zone, salary and contact details before our team reviews them; no user account data is sent
• Infrastructure providers: Amazon Web Services (our servers, database and image storage, located in Singapore) and Cloudflare (the network that carries data between you and our servers)
• Other users of the Platform — only the data you choose to publish in a job post
• Government authorities — when required by a court order or by law

We do not sell your personal data to third parties for marketing.

Some of the providers above may process or store data on servers outside Thailand. In that case we make sure the destination country has adequate data protection standards, or that appropriate safeguards are in place, as required by PDPA sections 28-29.

5. Cookies and tracking technologies

5.1 We use cookies that are necessary to log you in and keep you logged in. They are required to use the Platform and cannot be turned off.

5.2 When Google AdSense is enabled, Google may use cookies to show relevant ads. You can manage ad settings at Google Ads Settings

5.3 Ads created by the Goodjobclubs team itself do not track user behavior beyond picking an ad at random to display.

6. Your rights under the PDPA

You have the following rights over your personal data:

• Right of access (section 30)
• Right to data portability (section 31)
• Right to object to processing (section 32)
• Right to erasure or destruction (section 33)
• Right to restrict processing (section 34)
• Right to rectification (section 36)
• Right to withdraw consent (section 19) at any time
• Right to complain to the Personal Data Protection Committee (PDPC) office

To exercise these rights, email [email protected] with the details of your request and information to verify your identity. We will review and act on your request within 30 days of receiving a complete request.

How to delete your account and the data we received from Facebook or LINE is described on the User Data Deletion page.

Some of these rights may be limited where the law allows, for example where we must keep data to comply with another law (such as tax law) even if you ask us to delete it.

7. Security measures

We use appropriate technical and organizational measures to prevent unauthorized access, alteration, disclosure or destruction of personal data, such as encryption in transit (HTTPS), limiting data access to the administrators who need it, and not storing sensitive payment data ourselves.

8. Personal data breach notification

If a personal data breach poses a risk to your rights and freedoms, we will notify the Personal Data Protection Committee office within 72 hours of becoming aware of it (PDPA section 37(4)), and will notify you without undue delay if the breach poses a high risk to your rights and freedoms.

9. Minors

Users must be at least 15 years old. If you are under 20, some consents relating to personal data may require the consent of a parent or guardian, as set out in PDPA section 20. If we learn that we have collected data from a minor without valid consent, we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time to reflect changes in the law or in our service, and will let you know through appropriate channels when a change is significant.

11. Contact

If you have questions or want to exercise your PDPA rights over your personal data, please contact [email protected]