Privacy Policy

1Who We Are

NORDENFELD CO., LTD. is the "Data Controller" of your personal data under PDPA. We are a company registered in Thailand, Company Registration Number 0845566013565. Our registered office is at 14/102 Moo 2, Bo Phut, Koh Samui, Surat Thani 84320, Thailand. You can contact us at the address listed at the end of this Policy.

2The Personal Data We Collect

We collect different types of personal data depending on your relationship with us.

From Employers (businesses purchasing Packages):

• Identity data: your name, business name.
• Contact data: LINE ID, WhatsApp number, Facebook or Instagram account, phone number.
• Job brief data: role title, salary range, location, schedule, start date, and any other details you submit in our intake form.
• Payment data: handled directly by Stripe. We do not store full card details.
• Technical data: IP address, browser type, device information.
• Usage data: pages visited, actions taken on the Site.

From Candidates:

• Identity data: name, nickname, age, gender.
• Contact data: LINE ID, WhatsApp number, Facebook or Instagram profile, phone number.
• Professional data: work experience, qualifications, availability, salary expectations, location, preferred industry.
• Communication data: messages exchanged with us during pre-qualification.
• Optional data: photos, voice messages, or other content voluntarily shared by the Candidate.

From visitors to our website:

• Cookies and similar technologies (see Section 8).
• IP address, browser type, device type, referring URL.
• Pages visited, time on Site, click patterns.

We do not knowingly collect sensitive personal data (race, religion, political opinions, health, biometric or genetic data, etc.) as defined in PDPA Section 26. If you provide such data voluntarily, we will treat it under the stricter rules of PDPA Section 26.

3How We Use Your Personal Data and Our Legal Basis

Under PDPA, we must have a lawful basis for processing your data. The legal bases we rely on are:

For Employers:

• Performance of a contract (PDPA Section 24(3)): to deliver the Package you purchased.
• Legitimate interest (PDPA Section 24(5)): to operate, improve, and secure the Service.
• Legal obligation (PDPA Section 24(6)): tax, accounting, and other regulatory requirements.
• Consent (PDPA Section 24): for marketing communications, where applicable.

For Candidates:

• Consent (PDPA Section 24): you voluntarily provide your data in response to a job opportunity, with the understanding it will be forwarded to potential employers.
• Legitimate interest: to source qualified candidates for our Employer clients and to improve our matching process.

Specific purposes include:

• Providing the Service — sourcing, pre-qualifying, and delivering Candidates to Employers.
• Processing payments via Stripe.
• Communicating with you about the Service.
• Detecting and preventing fraud.
• Complying with legal obligations under Thai law.
• Improving the Service and our matching processes.

4Who We Share Your Data With

We share your personal data only with the following categories of recipients:

• Stripe, Inc. — for payment processing. Stripe acts as an independent data controller. Their privacy policy is available at stripe.com/privacy.
• Meta Platforms, Inc. (Facebook / Instagram) — for advertising, candidate sourcing, and customer communication via Messenger. Their privacy policy is available at facebook.com/privacy.
• LINE Corporation — when Delivery of Candidate contact details is made via the Employer's LINE account.
• Cloud service and website hosting providers — under data processing agreements.
• Professional advisors — lawyers, accountants, auditors when required.
• Government and regulatory authorities — when required by law.

We do not sell your personal data to any third party.

When we share Candidate contact details with Employers, we do so for the specific purpose of evaluating and potentially hiring the Candidate for the role submitted. Employers are contractually required (see our Terms of Service) to handle Candidate data in compliance with PDPA.

5International Data Transfers

Some of our service providers (notably Stripe and Meta) process data outside Thailand, primarily in the United States and the European Union.

When we transfer your personal data internationally, we ensure appropriate safeguards are in place under PDPA Section 28, including using service providers with data protection standards equivalent to PDPA, and relying on contractual data protection clauses where applicable.

6How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Employer account data: while you have an active relationship with us, plus 5 years thereafter for tax and accounting purposes.
• Candidate data: up to 12 months from the date of pre-qualification, or until the Candidate requests deletion (whichever is sooner).
• Payment records: as required by Thai tax law (typically 5 to 7 years).
• Website analytics data: typically 14 months.
• Communication records: 24 months from last interaction.

After the relevant retention period, we securely delete or anonymize the data.

7Your Rights Under PDPA

You have the following rights regarding your personal data, as set out in PDPA Sections 30 to 37:

• Right to be informed — to know how your data is collected and used (this Policy fulfills that obligation).
• Right to access — to request a copy of your personal data we hold.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — to request deletion of your data, where lawful.
• Right to restrict processing — to limit how we use your data.
• Right to data portability — to receive your data in a structured, commonly used format.
• Right to object — to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent — at any time, where consent is the legal basis for processing.
• Right to lodge a complaint — with the Personal Data Protection Committee (PDPC) of Thailand.

To exercise any of these rights, contact us via the channel listed at the end of this Policy. We will respond within 30 days of receipt as required by PDPA.

8Cookies and Similar Technologies

Our Site uses cookies and similar tracking technologies for the following purposes:

• Essential cookies — required for the Site to function (cannot be disabled).
• Analytics cookies — to understand how visitors use the Site.
• Marketing cookies — including the Meta Pixel, to measure ad effectiveness and re-target visitors.

You can control non-essential cookies through your browser settings or our cookie banner where available. Blocking essential cookies may prevent parts of the Site from working correctly. For more detail, see our Cookie Policy.

9How We Protect Your Data

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS / TLS).
• Access controls limiting who can view personal data internally.
• Secure storage with reputable cloud service providers.
• Regular review of our security practices.

However, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

10Children's Privacy

Our Service is intended for users aged 20 and older (the age of majority in Thailand). We do not knowingly collect personal data from individuals under 20 without parental consent as required by PDPA Section 20. If you believe we have inadvertently collected such data, please contact us and we will delete it.

11Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top reflects the most recent change. Material changes will be communicated through the Site. Continued use of the Service after changes constitutes acceptance.

12How to Exercise Your Rights and Contact Us

For any questions about this Policy, to exercise your PDPA rights, or to raise a privacy concern, contact us at the address listed below.

You may also contact the Personal Data Protection Committee of Thailand directly if you believe your rights under PDPA have been violated: www.mdes.go.th.