Privacy Policy

This policy explains how Zultgems Portal collects, uses and protects the personal data of its users under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

1. Data controller and system administrator

• Data controller: Zultgems Co., Ltd., Tax ID 0105553149940, No. 8/2 Soi Sukhumvit 42, Sukhumvit Road, Phra Khanong, Khlong Toei, Bangkok 10110, Thailand
• Data processor: an external service provider appointed to administer the system and provide accounting services, which processes data only on the data controller's instructions

2. Data we collect

• User account data: username, display name, role and access rights, and password (stored as a one-way hash; no one can see the actual password)
• Usage data: last sign-in time, and the IP address and browser type at the time consent is given
• Employee data: name, position, department, start date, line manager, leave, late arrivals, day-off changes and leave balances
• Health data (sensitive data): medical certificates and sick-leave records, kept to comply with labour protection law and the company's leave policy, and visible only to the employee concerned, their leave approvers and HR
• Accounting data entered into the system: such as ledgers, sales and purchase documents, tax, director loans and employee benefits, which may include names or details of business partners, directors or employees

3. Purposes and legal bases

• Providing the accounting and finance system under contract (contract)
• Preparing accounts, financial statements and taxes as required by law (legal obligation)
• Verifying identity, controlling access and preventing unauthorised access (legitimate interest)
• Managing employees' leave, holidays and attendance, including the annual bonus assessment (employment contract and labour-law obligations); health data is used only as labour protection law requires or permits

4. Disclosure

• The external service provider appointed to administer the system and provide accounting services
• Auditors and government authorities, such as the Revenue Department or the Department of Business Development, when required by law
• Cloud providers used to store and process the data, under industry-standard security measures

5. Transfer outside Thailand

The system's servers are located in Singapore. Data is sent over encrypted connections (HTTPS) and stored in storage that only system administrators can access.

6. Retention

• User account data: kept while you have access, then deleted or anonymised when access ends, unless needed for audit purposes
• Accounting and tax data: kept for no less than the periods required by accounting and tax laws
• Consent records: kept for as long as the system is used, as evidence of consent

7. Security

The system uses encrypted connections, stores passwords as one-way hashes, restricts access by user role, limits failed sign-in attempts, and backs up data regularly.

8. Cookies

The system uses only a strictly necessary cookie to keep you signed in (session cookie). There are no advertising or analytics cookies. If cookies are disabled in your browser, you will not be able to sign in.

9. Your rights

You have the right to access and obtain a copy of your data, to have it corrected, deleted or destroyed, to restrict or object to its processing, to data portability, and to withdraw consent at any time (without affecting processing carried out before withdrawal). You may also lodge a complaint with the Personal Data Protection Committee (PDPC).

10. Contact us

For questions or to exercise the rights in section 9, contact: [data protection contact email] or [phone number]

11. Changes to this policy

If this policy changes materially, the system will show you the new version and ask you to confirm it again when you sign in.

If the Thai and English versions differ, the Thai version prevails.